hmm ok, thanks for the information.

Now I'm wondering how I can explain THAT to the client :)

Steve

-----Original Message-----
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent: Thursday, January 23, 2003 11:02 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.Virus] Conflicting Encoding Vulnerability



>Sure - should of thought to give that on the first shot...

Actually, I should have caught this without looking at the logs -- for some 
reason, I was thinking of a different issue.  The problem is:

         ------=_NextPart_000_0005_01C2045D.33A4E770
         Content-Type: text/plain; charset="US-ASCII"
         Content-Transfer-Encoding: 7bit
         Content-Transfer-Encoding: quoted-printable

Here, the encoding is shown as both "7bit" and "quoted-printable."  Because 
of this, this MIME segment can be handled two different ways, and as a 
result, a virus could appear where no virus really is (if that makes any 
sense).

In this case, it appears that someone at AOL received an E-mail with a 
vulnerability and then forwarded it on to someone else.  So the problem 
here really lies with the sender of the original E-mail
(onlinerecommerce.com).
                                -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".    The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".    The archives can be found
at http://www.mail-archive.com.

Reply via email to