[Esd-l] Revised SoBig-F local rule

Scott Taylor scott at dctchambers.com
Thu Aug 21 07:46:00 PDT 2003

John D. Hardin said:

> Here's a revised rule based on the new SoBig-F variant's published
> details. It's a little more general than the one posted earlier.
> This is included in the sample local-rules file:
> 	http://www.impsec.org/email-tools/local-rules.procmail


That new rule doesn't seem to catch:
REPORT: Trapped poisoned executable "wicked_scr.scr"

There are a couple of very long lines there, should they be one line?
* 9876543210^1 ^Content-(Type|Disposition):.*name *=

More information about the esd-l mailing list