[Declude.Virus] Blank Folding
Why is this mail cached by the blank folder I can't see anywhere that there are an error which should cause this Benny Received: from mailgw2.mailserveren.com [213.236.237.229] by mx2.mailserveren.com with ESMTP (SMTPD32-7.13) id AE3826FC0024; Fri, 03 Oct 2003 11:15:36 +0200 Received: from bnserver01.bennin.no (a217-118-34-25.bluecom.no [217.118.34.25]) by mailgw2.mailserveren.com (Postfix) with ESMTP id 6B6B611D768 for [EMAIL PROTECTED]; Fri, 3 Oct 2003 11:28:48 +0200 (CEST) content-class: urn:content-classes:message Subject: =?iso-8859-1?Q?VS=3A_Storrengj=F8ring?= MIME-Version: 1.0 Content-Type: image/jpeg; name=dishwasher.jpg Content-Transfer-Encoding: base64 Content-Description: dishwasher.jpg Content-Disposition: attachment; filename=dishwasher.jpg Date: Fri, 3 Oct 2003 11:13:10 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.0.6375.0 Message-ID: [EMAIL PROTECTED] X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: =?iso-8859-1?Q?VS=3A_Storrengj=F8ring?= Thread-Index: AcOJjpB/chACwfE4QEeJ8limw8F/kA== From: Eivind Pettersen [EMAIL PROTECTED] To: =?iso-8859-1?Q?Helge_B=F8e_=28E-post=29?= [EMAIL PROTECTED], Carl E. M. Flygare (E-post) [EMAIL PROTECTED], Harald Fossum (E-post) [EMAIL PROTECTED], Petter(jobb) (E-post) [EMAIL PROTECTED], =?iso-8859-1?Q?Karl_Erik_Sletteb=F8e_=28E-post=29?= [EMAIL PROTECTED], X-Declude-Sender: [EMAIL PROTECTED] [213.236.237.229] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None [0] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Blank Folding
Why is this mail cached by the blank folder I can't see anywhere that there are an error which should cause this The Outlook Blank Folding Vulnerability occurs when there is a line in the headers with just a single space or a single tab character. In this case: From: Eivind Pettersen [EMAIL PROTECTED] To: =?iso-8859-1?Q?Helge_B=F8e_=28E-post=29?= [EMAIL PROTECTED], Carl E. M. Flygare (E-post) [EMAIL PROTECTED], Harald Fossum (E-post) [EMAIL PROTECTED], Petter(jobb) (E-post) [EMAIL PROTECTED], =?iso-8859-1?Q?Karl_Erik_Sletteb=F8e_=28E-post=29?= [EMAIL PROTECTED], X-Declude-Sender: [EMAIL PROTECTED] [213.236.237.229] The last header (before Declude added its headers) was a line with just a single tab character. This is in violation of RFC822 3.2.3, and creates the vulnerability. Even more interesting, it appears that the mail client dropped off one of the recipients -- the last one ends with a ,, which would imply that there were more addresses that disappeared. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Blank Folding
so just a wild guess if u sent to a group of your contacts in Outlook and is has a bad adresss this can happen ? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: 3. oktober 2003 15:35 To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Blank Folding Why is this mail cached by the blank folder I can't see anywhere that there are an error which should cause this The Outlook Blank Folding Vulnerability occurs when there is a line in the headers with just a single space or a single tab character. In this case: From: Eivind Pettersen [EMAIL PROTECTED] To: =?iso-8859-1?Q?Helge_B=F8e_=28E-post=29?= [EMAIL PROTECTED], Carl E. M. Flygare (E-post) [EMAIL PROTECTED], Harald Fossum (E-post) [EMAIL PROTECTED], Petter(jobb) (E-post) [EMAIL PROTECTED], =?iso-8859-1?Q?Karl_Erik_Sletteb=F8e_=28E-post=29?= [EMAIL PROTECTED], X-Declude-Sender: [EMAIL PROTECTED] [213.236.237.229] The last header (before Declude added its headers) was a line with just a single tab character. This is in violation of RFC822 3.2.3, and creates the vulnerability. Even more interesting, it appears that the mail client dropped off one of the recipients -- the last one ends with a ,, which would imply that there were more addresses that disappeared. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Blank Folding
so just a wild guess if u sent to a group of your contacts in Outlook and is has a bad adresss this can happen ? Only if the mail client is broken. The problem is that folding is used to take a long line and split it up into several smaller lines (if you have looked at Received: headers, most of them do this -- if the header starts with a space or a tab, it is a continuation of the previous line). However, with just a single space or tab, that's like taking one line and making two out of it, with the first line containing the whole line, and the second line completely blank. It just doesn't make any sense. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Spoofed Addresses
So this is implemented in the 1.76 beta which is on the page now? Thanks. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, October 02, 2003 5:01 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Spoofed Addresses I am sure this has been discussed many times in the past, but I have been out of the loop, so forgive me for asking again. How do you notify your customers who send viruses without notifying the ones with spoofed return addresses? When we had the SoBig virus going around, we had to literally shut off our notifications because people were blacklisting us because we were sending them Virus messages even though they didn't send the virus. There are two ways to handle this. Originally, the SKIPIFVIRUSNAMEHAS option was used to handle this. If you do that, you need to keep your \IMail\Declude\sender.eml and \IMail\Declude\otherpostmaster.eml files up-to-date as new forging viruses appear. However, starting with v1.76, Declude Virus will automatically check with our server to see if a virus is a forging virus, and automatically suppress the appropriate notifications if it is. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Blank Folding
The problem is that folding is used to take a long line and split it up into several smaller lines (if you have looked at Received: headers, most of them do this -- if the header starts with a space or a tab, it is a continuation of the previous line). However, with just a single space or tab, that's like taking one line and making two out of it, with the first line containing the whole line, and the second line completely blank. It just doesn't make any sense. -Scott thats right but if I send an email to someone this is taken automaticly to outlook and in outlook it just appeas as benny not the email address then Outlook will try to send to this contact even if there is not an email address in that contact, then this one will appear as blank and can cause this ? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Spoofed Addresses
However, starting with v1.76, Declude Virus will automatically check with our server to see if a virus is a forging virus, and automatically suppress the appropriate notifications if it is. So this is implemented in the 1.76 beta which is on the page now? Thanks. That is correct. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Blank Folding
thats right but if I send an email to someone this is taken automaticly to outlook and in outlook it just appeas as benny not the email address then Outlook will try to send to this contact even if there is not an email address in that contact, then this one will appear as blank and can cause this ? Unfortunately, I do not know under what situations Outlook will do this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Blank Folding
ok just trying to figure out why this is coming in the mail -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: 3. oktober 2003 16:52 To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Blank Folding thats right but if I send an email to someone this is taken automaticly to outlook and in outlook it just appeas as benny not the email address then Outlook will try to send to this contact even if there is not an email address in that contact, then this one will appear as blank and can cause this ? Unfortunately, I do not know under what situations Outlook will do this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Blank Folding
With no email address you would normally get a no transport provider available because outlook wouldn't know what to do with it. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of ISPhuset Nordic AS Sent: Friday, October 03, 2003 9:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Blank Folding The problem is that folding is used to take a long line and split it up into several smaller lines (if you have looked at Received: headers, most of them do this -- if the header starts with a space or a tab, it is a continuation of the previous line). However, with just a single space or tab, that's like taking one line and making two out of it, with the first line containing the whole line, and the second line completely blank. It just doesn't make any sense. -Scott thats right but if I send an email to someone this is taken automaticly to outlook and in outlook it just appeas as benny not the email address then Outlook will try to send to this contact even if there is not an email address in that contact, then this one will appear as blank and can cause this ? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
[Declude.Virus] Imail Issues
Hello all. In an attempt to help everyone with issues than have been reported lately, I have put together a survey that I would like everyone to take. I will then post the results here as well as send them to Ipswitch for review. I know we are all busy, but if I can take the hour it took to create this, you can take 5 minutes to fill it out. No tracking is being done, only the answers. (No IPs, No countries, No browser type, no e-mail, nothing.) The link is this: http://www.createsurvey.com/cgi-bin/pollfrm?s=11436magic=HoUsvn3wsnt8eJb There are no images, hence the red boxes. (Hey, what do you expect for free?) I will leave this up until next Wednesday night, October 8. Thanks for you participation. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
