[Esd-l] Re: Procmail Sanitizer local rule for SoBig .ZIP worm

[Smart,Dan]

Is this supposed to use the supreme value in the scoring?  In that case
shouldn't the scoring be:
* 9876543210^1  .  

In the tips I read..

SUPREME = 9876543210, is the highest score value that causes Procmail to
bail out. [david] Actually the maximum is 2147483647, but 9876543210 is
easier to remember/type and will function just as well. 

Upon reaching the supreme score, Procmail will skip all remaining weighted
conditions on the recipe, deeming them matched. Since all conditions on this
recipe are weighted, once Procmail finds one matched condition it will skip
the rest and execute the action. 


<<Dan>>




 

| 
| -----Original Message-----
| From: John D. Hardin [mailto:jhardin at impsec.org] 
| Sent: Friday, June 27, 2003 3:01 PM
| To: Email Security Discussion list
| 
| On Fri, 27 Jun 2003, Aaron Gladders wrote:
| 
| > Today a user complained of a SoBig worm getting through - it was 
| > because the attachment was labeled "your_details8.zip"
| 
| Any static pattern rule will rot.
| 
| I recommend the following change:
| 
|   * 987654321^1 ^Content-(Type|Disposition):.*$.*name *= 
| *"?(your_details|application|document|screensaver|movie)[0-9]*\.zip"?
| 
|   * 987654321^1 ^Content-(Type|Disposition):.*name *= 
| *"?(your_details|application|document|screensaver|movie)[0-9]*\.zip"?
| 
| Note the addition of [0-9]*
| 
| Thanks, Aaron!
| 
| --
|  John Hardin KA7OHZ    ICQ#15735746    http://www.impsec.org/~jhardin/
|  jhardin at impsec.org                        pgpk -a jhardin at impsec.org
|  key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
| --------------------------------------------------------------
| ---------
|   The fetters imposed on liberty at home have ever been forged out
|   of the weapons provided for defense against real, pretended, or
|   imaginary dangers from abroad.
|                                             -- James Madison, 1799
| --------------------------------------------------------------
| ---------
|    494 days until the Presidential Election
| 
| _______________________________________________
| Esd-l mailing list
| Esd-l at spconnect.com
| http://www.spconnect.com/mailman/listinfo/esd-l
|