From owner-freebsd-security  Tue Dec  4 23:10:10 2001
Delivered-To: freebsd-security@freebsd.org
Received: from lariat.org (lariat.org [12.23.109.2])
	by hub.freebsd.org (Postfix) with ESMTP id 7A6F137B417
	for <freebsd-security@FreeBSD.ORG>; Tue,  4 Dec 2001 23:10:07 -0800 (PST)
Received: from mustang.lariat.org (IDENT:ppp0.lariat.org@lariat.org [12.23.109.2])
	by lariat.org (8.9.3/8.9.3) with ESMTP id AAA00680;
	Wed, 5 Dec 2001 00:08:21 -0700 (MST)
Message-Id: <4.3.2.7.2.20011205000635.048414a0@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
Date: Wed, 05 Dec 2001 00:07:50 -0700
To: Len Conrad <LConrad@Go2France.com>, freebsd-security@FreeBSD.ORG
From: Brett Glass <brett@lariat.org>
Subject: Re: Mail list is posting gone virus!!!!
In-Reply-To: <5.1.0.14.2.20011204193019.05f01c18@mail.Go2France.com>
References: <4.3.2.7.2.20011204172959.04d112e0@localhost>
 <01d701c17d10$a8b334b0$0001300a@lhtech.lhtek.com>
 <C1EC3AA970F8D311BA4D0050BAB07BA870491B@nhex1101.cologic.co.nz>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

At 06:34 PM 12/4/2001, Len Conrad wrote:

>the freebsd hubs run postfix, afaik, which can block on single and double file extensions, like .scr, .doc.scr.

This helps, but it's far from the only heuristic to use.

Of course, since we're talking about mailing lists here, FreeBSD
should probably just strip all attachments and defang or block
active content.

--Brett


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message