AFAIK, yes, the situation is still the same: no turning params available. This is the only info in pam.chm (KB #2190):
=========== Content_Compound_File_Bad_Extension Description This signature triggers when a compound file is found that has an inappropriate file name extension. "Compound file" refers to a specific file format used to store data by a number of Microsoft applications like Excel and Word. Type Attack Priority high Algorithm Id 2106192 Bugtraq References BID-13132 CVE References CVE-2005-0063 Known False Negatives A compound file may have an appropriate file name extension, yet still be a threat to a particular desktop system. If the file name extension is valid, but not recognized because the associated software is not installed, the file still poses a threat. For example, a malicious Microsoft Word document with the expected ".doc" extension is a threat to a system that does not have Microsoft Word installed. Vulnerabilities Exploited Microsoft Windows HTML Application Host command execution =========== --- Best regards, Sergey V. Soldatov. Information security department. tel/fax +7 495 745 89 50 tel +7 495 777 77 07 (1613) > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Johnson, Scott > Sent: Thursday, February 22, 2007 8:03 PM > To: [email protected] > Subject: [ISSForum] Content_Compound_Bad_File_Extension tunable? > > Last September I inquired with tech support about tuning the > signature Content_Compound_Bad_File_Extension. I was told > there was no pam or white list for this signature. > > Is this still the case? > > > > Scott Johnson > > Information Security > > Electric Reliability Council of Texas > > www.ercot.com > > Office: 512-248-3152 > > Cell: 512-917-9844 > > > > _______________________________________________ > ISSForum mailing list > [email protected] > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to > https://atla-mm1.iss.net/mailman/listinfo/issforum > > To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] > > The ISSForum mailing list is hosted and managed by Internet > Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. > _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
