I use inflex (http://www.spyda.co.za) to preprocess all incoming

mail before it even hits the corporate network. I stopped

the ILOVEYOU virus 30 minutes after we found out about it.

Ditto for the Amex confirmation thing. (we just stopped

all *.vbs attachments).

Inflex runs all attachments through a virus checker also.

And it's open source. (Hell, it's just a shell script!)

I added the following lines to inflex as soon as we found

out about the buffer overrun:

# check for long date field buffer overrun:

CC=`grep "^Date: " ${tmpdir}/receivedmail | head -1 | wc -c`

if [ $CC -gt 45 ] ; then

# carrying the outlook buffer overrun hack:

grep -n "" ${tmpdir}/receivedmail | head -20 | sed "s/:/: /" | mail -s "Outlook buffer overrun hack" $administrator

sed "s/^Date: .*$/Date: Invalid Date Format/" ${tmpdir}/receivedmail > ${tmp

dir}/date$$

cat ${tmpdir}/date$$ > ${tmpdir}/receivedmail

rm ${tmpdir}/date$$

fi

I think the lesson here is that preprocessing is the way

to handle all this stuff.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/62/2665#2665