https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7521

--- Comment #2 from Kevin A. McGrail <[email protected]> ---
New Version for feedback.  I've expanding the control char check.

#MAILSPLOIT CONTROL CHARACTER - Thanks to Jan-Pieter Cornet for the idea
 #All Control chars like NUL except \n which should exist once legitimately
header   __KAM_MAILSPLOIT1   From =~ /[\x00-\x09\x0b-\x1f]/
describe __KAM_MAILSPLOIT1   RFC2047 Exploit https://www.mailsploit.com/index

 #\n Multiple in the From Header
header   __KAM_MAILSPLOIT2    From =~ /[\n]/
describe __KAM_MAILSPLOIT2    RFC2047 Exploit https://www.mailsploit.com/index
tflags   __KAM_MAILSPLOIT2    multiple maxhits=2

meta            KAM_MAILSPLOIT  (__KAM_MAILSPLOIT1 || (__KAM_MAILSPLOIT2 >= 2))
describe        KAM_MAILSPLOIT  Mail triggers known exploits per mailsploit.com
score           KAM_MAILSPLOIT  10.0

-- 
You are receiving this mail because:
You are the assignee for the bug.

Reply via email to