On 3/20/11 6:04 AM, Matt Elson wrote:
body __PILL_PRICE_3
/free\s(?:pill|tablet|cap(?:sule|let))s/i
tflags __PILL_PRICE_3 multiple
Specifically, they're causing spamassassin to run in an endless loop
when the tflags line active when the rule hits. Debug just shows the
following line endlessly:
Mar 20 05:37:56.391 [6677] dbg: rules: ran one_line_body rule
__PILL_PRICE_3 ======> got hit: "Free Pills"
I don't have a full example of an email that triggers this, but I have
the body of one that will regularly trigger it here:
http://pastebin.com/iGQ2RJ6v
Works here, compiled rules, freebsd 7.3, amd64, perl 5.10, re2c, 0.13.5
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation
* Best Intrusion Prevention Product, Networks Product Guide
* Certified SNORT Integrator
* Hot Company Award, World Executive Alliance
* Best in Email Security, 2010 Network Products Guide
* King of Spam Filters, SC Magazine
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
