Re: MyDoom.o: Time to move to MIME ACL

Messages with problem attachments can be rejected with:

	warn	message = X-Your-Virus-Header: Defective attachment: 
$demime_reason
		log_message = RCPT <$local_part@$domain>: Defective attachment: 
$demime_reason
		demime = *
		condition = ${if >{$demime_errorlevel}{2} {1}{0}}

Rejecting a message after DATA often results in a re-try by the sending 
server, so it's a good idea to use warn. On the other hand, if you use 
the virus header to quarantine messages, legitimate (but mime-defunct) 
messages will not be bounced.

Unfortunately, legitimate email can easily contain mime errors. For 
example:

double headers (content-type, content-disposition or 
content-transfer-encoding)
quoted-printable encoding contains illegal character
base64 line contains illegal character

That's why the docs suggest only acting on email with more than 2 
errors. Microsoft Exchange V6, mailing lists, and other clients 
frequently use base64 to encode simple message text. So, many of the 
errors you see in your log are probably not viruses, just non-compliant 
encoded text.

ClamAV catches all known variants of MyDoom, and we haven't had many 
slip by while using it. The only exception is the brief time between an 
outbreak and definition update, but blocking common executable file 
types and password-protected zips helps.

Anyone else long for the days of pure-text email..

Rich
[email protected]

On Friday, July 30, 2004, at 09:30 AM, Steven Dickenson wrote:

> I've seen two MyDoom.o viruses slip pass my Exim MX and get picked up 
> by  McAfee on my Exchange server.  A quick check of the logs indicates 
> errors such as these:
>
> demime acl condition: base64 line contains illegal character
> demime acl condition: base64 line length is not a multiple of 4 
> characters
> demime acl condition: base64 line length exceeds 76 characters
>
> It would seem the simple demime acl in the DATA section is no longer 
> sufficient for catching some of the nastier Windows viruses.  
> Therefore, I'd like to move over the the MIME ACL, however I'm not 
> seeing any overview examples of implementations.  I wish to reject 
> based on a small list of file extensions and do virus scanning with 
> ClamAV.  I also want to avoid filename decoding problems due to base64 
> header encoding (which I assume what the above error is).
>
> Can someone give me an idea of the best way to accomplish this?  Is 
> there a resource for examples of ACL checks that can be done with the 
> MIME acl?
>
> Thanks,
> Steven
> -- 
> Steven Dickenson <[email protected]>
> http://www.mrchuckles.net
>
>