[Esd-l] Re: [Esa-l] Sanitizer rule for Novarg .ZIP attack

Simon Matthews simon at paxonet.com
Thu Jan 29 12:45:24 PST 2004


John, and others,

I've seen a few copies of a variant that has no subject, no text (to be 
more accurate, it claims to have to have a section that uses Windows-1252 
charset, but it's empty), just a zip file attachment.

Any suggestions on filtering? Anyone want to see a copy?

Simon



More information about the esd-l mailing list