[Esa-l] NOTICE: you probably should add *.CPL to your poison list

John D. Hardin jhardin at impsec.org
Tue May 4 09:23:28 PDT 2004


All:

Windows email worms have started using .CPL attachments for the attack
payload. *.CPL was not in the recommended poison list until last week;
if you are not mirroring the recommended poison list you may want to
make sure *.CPL appears in your poisoned or stripped attachments list.

--
 John Hardin KA7OHZ    ICQ#15735746    http://www.impsec.org/~jhardin/
 jhardin at impsec.org    FALaholic #11174    pgpk -a jhardin at impsec.org
 key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  Bush? Kerry? I'm so sick of our elections always being "choose the
  lesser of two evils."
-----------------------------------------------------------------------
   182 days until the Presidential Election


More information about the esa-l mailing list