From owner-freebsd-security@FreeBSD.ORG Mon Mar 31 12:06:10 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EEC6D37B401 for ; Mon, 31 Mar 2003 12:06:10 -0800 (PST) Received: from gw.nectar.cc (gw.nectar.cc [208.42.49.153]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4401143F93 for ; Mon, 31 Mar 2003 12:06:10 -0800 (PST) (envelope-from nectar@celabo.org) Received: from madman.celabo.org (madman.celabo.org [10.0.1.111]) (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)) (Client CN "madman.celabo.org", Issuer "celabo.org CA" (verified OK)) by gw.nectar.cc (Postfix) with ESMTP id D289166; Mon, 31 Mar 2003 14:06:09 -0600 (CST) Received: by madman.celabo.org (Postfix, from userid 1001) id 60E4A78C66; Mon, 31 Mar 2003 14:06:09 -0600 (CST) Date: Mon, 31 Mar 2003 14:06:09 -0600 From: "Jacques A. Vidrine" To: Mike Tancsa Message-ID: <20030331200609.GB41695@madman.celabo.org> Mail-Followup-To: "Jacques A. Vidrine" , Mike Tancsa , freebsd-security@freebsd.org References: <3E887850.7010100@drweb.ru> <3E887850.7010100@drweb.ru> <5.2.0.9.0.20030331143557.07ea0858@marble.sentex.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5.2.0.9.0.20030331143557.07ea0858@marble.sentex.ca> X-Url: http://www.celabo.org/ User-Agent: Mutt/1.5.3i-ja.1 cc: freebsd-security@freebsd.org Subject: Re: what was that? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Mar 2003 20:06:12 -0000 On Mon, Mar 31, 2003 at 02:39:49PM -0500, Mike Tancsa wrote: > Actually, will not some MS email clients (e.g. lookOUT) honor attachments > that begin in the headers ? I recall a discussion similar to this on email > AV scanner lists... Because MS would decode an attachment crammed in the > subject line, this could be a way to bypass email scanners and cram viruses > in the subject... Combined with the fact that there are many unpatched > email clients out there, this would be a nice way to spread an email worm. > > Perhaps the MS client would try and decode an attachment in the messageID ? That would explain why someone was sending such a Message-ID header, and I guess I would not be surprised that some Microsoft MUA would do something bone-headed like that. Cheers, -- Jacques A. Vidrine http://www.celabo.org/ NTT/Verio SME . FreeBSD UNIX . Heimdal Kerberos jvidrine@verio.net . nectar@FreeBSD.org . nectar@kth.se