[Esa-l]Bug report or just a feature ?

[Brent Wallis]

Hi,
The number of "." in the file name is the problem.
A common method of attack is to hide an executable behind a "valid"
extension...
eg:
"virus.exe.doc"
Hope it helps
Brent Wallis


-----Original Message-----
From: esa-l-admin at spconnect.com [mailto:esa-l-admin at spconnect.com]On Behalf
Of Zilvinas Atkociunas
Sent: Tuesday, July 31, 2001 6:28 PM
To: esa-l at spconnect.com
Subject: [Esa-l]Bug report or just a feature ?


Hello,

REPORT: Trapped poisoned Microsoft attachment
"M.C.SomeCompany.offer.31.07.2001.am.xls"
REPORT: Not a document, or already poisoned by filename. Not scanned for
macros.
STATUS: Message quarantined in /var/spool/mail/quarantine, not delivered to
recipient

This type of file makes procmail rules to move it to quarantine instead of
not doing so (because *.xls type of file is not in my poisoned files list).

Best regards,

Zilvinas
_______________________________________________
E-mail Security Announce list mailing list
E-mail Security Announce list at spconnect.com
http://www.spconnect.com/mailman/listinfo/esa-l