RE: [Declude.Virus] Paypal and "Outlook 'Blank Folding' Vulnerability"

[John Tolmachoff \(Lists\)]

Well, I still see Code Red connection attempts occasionally in my firewall logs.   John Tolmachoff Engineer/Consultant/Owner eServices For You   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Friday, September 24, 2004 6:54 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Paypal and "Outlook 'Blank Folding' Vulnerability"   John Tolmachoff (Lists) wrote: <>However, the post I was responding to was questioning whether or not there was an actual vulnerability, not what to do with it. What you define it as is subjective.  There is no exploit present in the messages that are being blocked, and the true vulnerability exists not in the E-mail but in Outlook, and I believe that a patch was issued quite a while ago for it.  Declude doesn't detect an actual exploit, just the precursors for the exploit, in this case a line in the headers with a single space.  Clearly this is not RFC compliant, but we also don't live in a perfect world.  I like the idea of being able to detect this, but I would only turn it on after finding out that there was code in the wild that was actively exploiting it.  There would be no need to turn off the vulnerability detection in Declude if the exploit code was detected in association with the condition because that would seem to be a perfect hit, but considering the time involved to create a suitable parsing engine to do this, it seems like a better idea to just provide the granularity.  I believe that the exploit in this case simply creates the ability to bypass virus scanners by putting the attachment in the message headers, and Outlook will read the attachment despite it being misplaced/malformed.  That in itself won't infect a computer, but it does make it easy to get past virus scanning software. I also don't think it would be a bad idea to maybe retire some of these things due to patching, but granularity would provide that capability for us to do this on our own.  Viruses will have a very hard time spreading when they utilize an exploit that has been patched for a year or more and I would think that with so many other forms of exploits available to them, they would choose something more likely to be successful.  For instance, any virus writer would be properly targeting the JPG vulnerability in Microsoft products for some time to come.  As things stand, most every desktop scanner is set by default to ignore JPG files, and intercepting such files for scanning prior to display in Internet Explorer could drive many machines into the ground in terms of performance.  Shame on Microsoft. Matt -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================