[Esd-l] ANN: Procmail Sanitizer 1.136 released

[John D. Hardin]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


The procmail sanitizer has been updated. The current version is 1.136
It is available via:

US/WA:  http://www.impsec.org/email-tools/procmail-security.html
US/FL:  http://stonewall.lbhs.net/~jhardin/email-tools/procmail-security.html
EU/NO:  http://jhardin.oftedal.no/email-tools/procmail-security.html
EU/NL:  http://kanon.net/~jhardin/email-tools/procmail-security.html
AU:     http://grebopple.accessunited.com.au/email-tools/procmail-security.html
AU:     http://impsec.fuzzitech.net/email-tools/procmail-security.html

Direct links to the current tarball:

US/WA:  http://www.impsec.org/email-tools/procmail-sanitizer.tar.gz
US/FL:  http://stonewall.lbhs.net/~jhardin/email-tools/procmail-sanitizer.tar.gz
EU/NO:  http://jhardin.oftedal.no/email-tools/procmail-sanitizer.tar.gz
EU/NL:  http://kanon.net/~jhardin/email-tools/procmail-sanitizer.tar.gz
AU:     http://grebopple.accessunited.com.au/email-tools/procmail-sanitizer.tar.gz
AU:     http://impsec.fuzzitech.net/email-tools/procmail-sanitizer.tar.gz


html-trap.procmail:
     $Id: html-trap.procmail,v 1.136 2002-10-20 10:38:14-07 jhardin Exp jhardin $
     $Revision: 1.136 $
     $Date: 2002-10-20 10:38:14-07 $
     $Revision: 1.136 $
2f8be4762cd1306a37be4d1d244a0e78  html-trap.procmail


- From the changelog:

10/20/2002 (1.136)
Added CPL (Control Panel applet) and WSZ (WinAmp skin - scriptable) to
  default list of executable extensions.
Handle extension-only filenames properly.
Don't corrupt HTML-encoded multibyte characters.
Collapse runs of spaces in filenames before length-limiting.
Don't lose original extension(s) during length-limiting.
Add a kill-all-EXEs option ($SECURITY_POISON_WINEXE) to check base64
  body for WIN exe magic.
Mangle MIME type to TEXT/PLAIN instead of APPLICATION/OCTET-STREAM to
  (hopefully) prevent magic scanning and execution.
Detect MSWord INCLUDETEXT and INCLUDEPICTURE as an attack in macro
  scanner.
Special case for sender detection in messages from AOL.
Smarten up sender postmaster notification a bit.


The sanitizer home page is at
http://www.impsec.org/email-tools/procmail-security.html

The archive of the sanitizer discussion list is at
http://www.spconnect.com/mailman/listinfo/esd-l



-----BEGIN PGP SIGNATURE-----
Version: PGP 5.0
Charset: noconv

iQA/AwUBPbLq3Ngi5ua4cy55EQLAUQCeNhAuPLWSRJGYFL2JsvX7PMQPHUIAnRnn
BoBTNL0tY3glDELTpKRbr+BI
=gTUk
-----END PGP SIGNATURE-----

--
 John Hardin KA7OHZ    ICQ#15735746    http://www.impsec.org/~jhardin/
 jhardin at impsec.org                        pgpk -a jhardin at impsec.org
 key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  ...the Fates notice those who buy chainsaws...
                                              -- www.darwinawards.com
-----------------------------------------------------------------------
   59 days until The Two Towers