> I've been able to grab hold of one of these messages; it seems the worm
> is sending the mail with incorrect mime headers; it does not put quotes
> around the filename:
> Content-Type: audio/x-midi;
> name=Fichiers AUDIO mr. malpoli CD 1.scr
> Content-Transfer-Encoding: base64
> Content-ID: <T1HIVTvXb5n1k>
I've seen there's a fix for this in anomy-1.56, so I tested it.
Anomy does fix the incorrect mime header when the "name=" on a seperate
line, but it still doesn't see the right name when all of this is on the
same line, e.g.:
Content-Type: audio/x-midi; name=hi.gif blah.scr
Maybe the regexp needs to be massaged a bit?
-- Tom Vandepoel Security Architect
Ubizen - Philipsite 5 - 3001 Heverlee - Belgium T: +32 16 28 70 00 F: +32 16 28 71 00
Ubizen - We Secure e-Business - www.ubizen.com