RE: Help for a newbie

"Andrzej Kukula" <[email protected]>
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Hello,

I think if you forward a mail message, the virus will be detected. The
problem is with bounces without MIME headers. 

It is SERIOUS VULNERABILITY. I can prepare a mail message that won't
appear to be a bounce, but will be, and it will carry a virus and let it
through undetected. User then will doubleclick it in their Outlook
[Express] and execute the virus. I just don't want to post the recipe on
a public mailing list.

I think it should be fixed ASAP.

Regards,
Andrzej Kukula

> From: [email protected] 
> [mailto:[email protected]] On Behalf Of Sean Schipper
>
> FYI,
>    I'm having the same problem.  I think I read somewhere on 
> this list 
> that messages that contain virus-infected attachments that have been 
> forwarded, are not able to be successfully detected by sophie at this 
> point.  Is this correct?
> 
> 
> Sean Schipper
> Lawrence University
> 
> Sergio Gonzalez wrote:
> 
> > Hi again Maex.
> > 
> > 
> >> To eliminate the obvious: you did restart sophie, right?
> > 
> > 
> > Yes, I did. :-)
> > 
> > 
> >> > What other SAVI options do I have to turn on/off?. This is what 
> >> > I've
> >> in my
> >> > sophie.savi file:
> >>
> >> Hmmm ... currently there are a lot of problems with the 
> Mime handling 
> >> so I'd suggest to set  Mime:0 I don't know about current 
> Disinfection 
> >> status, but I run without it. Most modern viruses don't carry any 
> >> useful information so even if they can be disinfected 
> nothing useful 
> >> remains, so I use  GrpDisinfect: 0
> >>
> >> Sophie reports Skip:0 for me, but I have no idea what it does and 
> >> can't find it in my SAVI documentation.
> >>
> >>         \Maex
> > 
> > 
> > Not so lucky yet. I turnd off Mime, GrpDisinfect and Skip, but still
> > doesn't work.
> > 
> > :-(
> > 
> > I hope someone find a solution for mime stuff soon.
> > 
> > :-(
> > 
> > 
> > Thanks a lot anyway!!
> > 
> > 
> > 
> > 
> > 
> > Sergio Gonzalez
> > [email protected]
> > 
> > _______________________________________________
> > vtools mailing list
> > [email protected] http://www.vanja.com/list/listinfo.cgi/vtools
> 
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.