[Esd-l] encoded-filename ZIP attachments
John D. Hardin
jhardin at impsec.org
Sun Sep 19 20:58:26 PDT 2004
All:
There's a worm going around that has a ZIP attachment with a
base64-encoded filename. The current release sanitizer does NOT catch
it because it currently does not decode filenames. I have added
a check for the ZIP MIME type so the next release (tomorrow?) should
catch it.
Grab the dev snapshot if you don't want to wait for the release.
The dev snapshot also fixes an infinite-loop bug on certain zip
attachments.
--
John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/
jhardin at impsec.org FALaholic #11174 pgpk -a jhardin at impsec.org
key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Bush? Kerry? I'm so sick of our elections always being "choose the
lesser of two evils."
-----------------------------------------------------------------------
44 days until the Presidential Election
More information about the esd-l
mailing list