File extension filtering

Hello,

I'd like to propose small modifications in the acl_check_mime part of 
exim's configure.default:

----------
   # File extension filtering.
-  deny message = Blacklisted file extension detected
+  deny message = Blacklisted file extension detected ($mime_filename)
        condition = ${if match \
                         {${lc:$mime_filename}} \
-                       {\N(\.exe|\.pif|\.bat|\.scr|\.lnk|\.com)$\N} \
+ 
{\N(\.exe|\.pif|\.bat|\.scr|\.lnk|\.com\.vbs|\.bas|\.cpl)[ \t]*$\N} \
                      {1}{0}}
----------

The "($mime_filename)" part in the message is to make the log more useful, 
allowing for analysis on file names so as to evaluate the trend in current 
viruses.

The "[ \t]*" at the end of the regex is for attached files with various 
combinations of trailing spaces and tabs at the end of the file name. 
Trailing spaces and tabs don't prevent the file to be executed under 
Windows. I've seen a few specimen of those going through my server.

The ".vbs,.bas,.cpl" extensions that I propose to add are based on 
experience, having seen some specimen of those too,... with virus inside of 
course.

Since this very simple rule is the number one virus catcher in ACL, I think 
it could be useful to make it as efficient as possible in the 
configure.default.


Cheers,
--
Didier Lebrun
Le bourg - 81140 - Vaour (France)
tél: 05.63.53.73.41 (AM et soirée)
mailto:[email protected] (MIME, ISO latin 1)
http://didier.quartier-rural.org/