From owner-freebsd-security Tue Jul 28 20:01:46 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id UAA20785 for freebsd-security-outgoing; Tue, 28 Jul 1998 20:01:46 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from lariat.lariat.org (ppp1000.lariat.org@[206.100.185.2]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id UAA20767 for ; Tue, 28 Jul 1998 20:01:43 -0700 (PDT) (envelope-from brett@lariat.org) Received: (from brett@localhost) by lariat.lariat.org (8.8.8/8.8.8) id VAA28924; Tue, 28 Jul 1998 21:01:09 -0600 (MDT) Message-Id: <199807290301.VAA28924@lariat.lariat.org> X-Sender: brett@mail.lariat.org X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.1 Date: Tue, 28 Jul 1998 21:01:06 -0600 To: security@FreeBSD.ORG From: Brett Glass Subject: Re: Any procmail experts here? In-Reply-To: <199807290159.TAA26543@lariat.lariat.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Whoops.... As many of you have doubtless already noted, the header we need to catch is Content-Disposition: attachment; filename="" --Brett At 07:59 PM 7/28/98 -0600, Brett Glass wrote: >We have dozens of users who might get bit by the MIME filename buffer >overflow bug described at > >http://www.sjmercury.com/business/microsoft/docs/security0728.htm > >and would like to try to use procmail to plug the hole (it seems to be the >best tool for the job). However, I have no experience with procmail. Could >someone help me write a procmail.rc that will eliminate the extra-long >filenames, truncating them back to (say) 64 characters max? All that's >required is to recognize the Content-type: .... filename="" header >and make sure that is chopped if it's too long. > >This would be a fix for which thousands of sysadmins would be exceedinglyy >grateful. > >--Brett > > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message