Re: Unfortunate interaction between EZMLM and MessageLabs virus scanning

From: der Mouse (mouseat_private)
Date: Fri May 10 2002 - 20:23:45 PDT

  • Next message: Andrew Clover: "Re: GOBBLES SECURITY ADVISORY #33"

    >> The widely used mailing list manager, EZMLM
    >> (http://cr.yp.to/ezmlm.html), when sending mails for moderation,
    >> sets a reply-to address which, if responded to, will cause the mail
    >> to be accepted for distribution.
    
    >> MessageLabs (http://www.messagelabs.com/) offer an email virus
    >> scanning service which, unfortunately, sends virus alerts to,
    >> amongst others, the reply-to address.
    
    > This is definitely a very troubling interaction between two programs.
    > Without further information, of course, it's difficult to state where
    > the problem needs to be fixed.
    
    IMO it's in MessageLabs.  I am on a number of mailing lists that
    regularly get hit with "we found a virus in a message from you" alert
    messages, far more than there actually are infected messages coming
    through the list.  I can only infer that someone is sending the viri
    with the list address forged into one of the from-type fields.  I'm
    sorely tempted to make my incoming email filters recognize the "alert"
    annoygrams and autocomplain about them.
    
    If a message must be auto-generated (which I'm far from convinced of),
    IMO the only acceptable place to send it is the envelope-from.
    
    /~\ The ASCII				der Mouse
    \ / Ribbon Campaign
     X  Against HTML	       mouseat_private
    / \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
    



    This archive was generated by hypermail 2b30 : Sat May 11 2002 - 16:13:11 PDT