Re: IE_VULN 100.00 ?

2005-11-02 Thread wolfgang
In an older episode (Wednesday, 2. November 2005 12:11), Simon Hogg wrote:
 Folks, we've been using SpamAssassin as part of MailScanner for just 
 over  a year with no problems at all.

 We have the threshold set at 6 for spam, but this scores 100.00 on IE_VULN.
 
 Can it be that the content of the file is being mistaken for something 
 else? I've found no reference to IE_VULN in any of the FAQ's, mail 
 archives, google (except one reference to the same score), hence my 
 posting to this list.

IE_VULN does not appear to be a rule that is contained within spamassassin 
3.0.4 or any of the SARE rules we are using. Is that part of some custom 
local rule of yours?

cheers,

wolfgang


Re: IE_VULN 100.00 ?

2005-11-02 Thread Steve Freegard
Hi Simon,

On Wed, 2005-11-02 at 11:11 +, Simon Hogg wrote:
 Folks, we've been using SpamAssassin as part of MailScanner for just 
 over  a year with no problems at all.
 
 However, output (plain ASCII text files of a few k in size) from out 
 student admin system, which is mailed to users of the system, is now 
 being flagged as spam. Below are the relevant bits of a header.
 
 The content of the file(?), the file name, the file size, the sender 
 (shown as 'x' here, but is a valid user), the recipient (a valid user),
 would appear to be ok. I can't provide a copy of the file content for 
 obvious reasons (personal details), which is not much help, although its 
 plain ASCII text, it is mostly in upper case and consists of just a  few 
 lines of text, ie names, course codes, grades etc.
 
 We have the threshold set at 6 for spam, but this scores 100.00 on IE_VULN.
 
 Can it be that the content of the file is being mistaken for something 
 else? I've found no reference to IE_VULN in any of the FAQ's, mail 
 archives, google (except one reference to the same score), hence my 
 posting to this list.

Yes - it's definitely being mistaken.  IE_VULN was a ruleset added to
MailScanner's spam.assassin.prefs.conf to catch a nasty IE bug a while
back.  It's dead and buried now - so you can safely remove the rule.

Cheers,
Steve.