Re: [AMaViS-announce] UPDATE: Re: [AMaViS-user] RE-ISSUED: ASA-2001-1: eMail worm W32/Aliz may not be detected (AMaViS 0.2.1)

[Rainer L. <li...@su...>]

On Sun, 25 Nov 2001, Rainer Link wrote:

> Just as an additional information: this worm uses a bug in Outlook, see
>
> http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-020.asp
>
> for details.
>
> Moreover, it seems W32/BadTrans-B is currently (very?) active, which
> "exploits" AFAIK the same bug. So, hopefully everyone using AMaViS 0.2.1
> with reformime either uses ripMIME now or has updated to
> amavis-perl/amavis.

OK, just for clarification. The mentioned Outlook bug has nothing to do
with the reformime issues. reformime is able to parse mails with
32/BadTrans-B correctly (at least the samples I've checked[1]). I aplogize
for sending out information without prior verification by myself.

best regards and good night :-)

Rainer Link
(SuSE Labs)

[1] well, with W32/Aliz reformime failed only by some samples we've
received, as not every sample got the problematic header entry as
explained in the ASA.

-- 
Rainer Link  |                SuSE - The Linux Experts
li...@su... |  Developer of A Mail Virus Scanner (www.amavis.org)
www.suse.de  | Founder OpenAntiVirus Project (www.openantivirus.org)