From owner-freebsd-stable  Sun Apr 14 14:43:37 2002
Delivered-To: freebsd-stable@freebsd.org
Received: from ion.gank.org (ion.gank.org [64.81.113.130])
	by hub.freebsd.org (Postfix) with ESMTP id 7205B37B405
	for <stable@freebsd.org>; Sun, 14 Apr 2002 14:43:32 -0700 (PDT)
Received: from aldaris (dsl081-113-221.dfw1.dsl.speakeasy.net [64.81.113.221])
	by ion.gank.org (GankMail) with ESMTP
	id AB85C30D; Sun, 14 Apr 2002 16:44:32 -0500 (CDT)
Message-ID: <00fc01c1e3fd$6b3a79f0$5f45a8c0@auir.gank.org>
Reply-To: "Craig Boston" <craig@meoqu.gank.org>
From: "Craig Boston" <craig@meoqu.gank.org>
To: "Juha Saarinen" <juha@saarinen.org>
Cc: <stable@freebsd.org>
References: <Pine.WNT.4.43.0204150932570.3044-100000@den2>
Subject: Re: Antigen Notification:Antigen found VIRUS= HTML\MimeExploit.IFRAME (CA(InoculateIT),CA(Vet)) virus (fwd)
Date: Sun, 14 Apr 2002 16:43:29 -0500
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4807.1700
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-stable.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-stable>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-stable>
X-Loop: FreeBSD.ORG

No, from the headers it looks like tig-msxproto1.tig.mizzou.edu is.  It also
looks like their antigen server is using an invalid envelope sender (simply
<antigen> with no domain name).

AFAIK, freebsd.org *DOES* use Postfix, however, and it assumes unqualified
addresses are local and rewrites them with its own domain name...  So
<antigen> becomes <antigen@freebsd.org>.  Maybe one of the Postfix gurus can
come up with a regex match to prevent stuff like this from masquarading as a
valid address.

cb

----- Original Message -----
From: "Juha Saarinen" <juha@saarinen.org>
To: <freebsd-stable@freebsd.org>
Sent: Sunday, April 14, 2002 4:33 PM
Subject: Antigen Notification:Antigen found VIRUS= HTML\MimeExploit.IFRAME
(CA(InoculateIT),CA(Vet)) virus (fwd)


> Errr... "antigen@freebsd.org"? Is the list running $Exchange?
>
> --
> Juha Saarinen
>
> ---------- Forwarded message ----------
> Date: 14 Apr 2002 16:23:14 -0500
> From: "Antigen@FreeBSD.ORG" <Antigen@FreeBSD.ORG>
> To: "freebsd-stable@FreeBSD.org" <freebsd-stable@FreeBSD.org>
> Subject: Antigen Notification:Antigen found VIRUS= HTML\MimeExploit.IFRAME
>     (CA(InoculateIT),CA(Vet)) virus
>
> Antigen for Exchange found Unknown infected with VIRUS=
HTML\MimeExploit.IFRAME (CA(InoculateIT),CA(Vet)) virus.
> The file is currently Removed.  The message, "Height", was
> sent from Sylvia.Patai  and was discovered in SMTP Messages\Outbound
> located at University of Missouri/Tigers/TIG-MSXPROTO1.
>
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-stable" in the body of the message
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-stable" in the body of the message
>
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message