Headers with extra whitespace missing filters in Exchange/Outlook ?

["Stewart, John" <jo...@artesyncp.com>]

We're running SpamAssassin 2.63 with amavisd-new-20030616-p5 and postfix as
a frontend to our Exchange server (yes, it all needs to be updated, but
still working damn well). SA/amavisd-new tags all mail with scores (dropping
stuff with scores over 20), and it's up to Exchange rules to filter to Spam
folders for the end users.

A few months ago I started to see an occasional email come through to the
client with the X-Spam headers showing up in the body of the email rather
than the header (and since the rules trigger on the header, not getting
filtered as spam by the client rules).

Attached is an example of one of these emails. It appears that there is a
space between the original header and the X-Spam headers, which I think is
what is causing the client to consider the space to mark the beginning of
the body.

Anyone seen this? The email shows up in the Outlook client with this at the
top, followed by the pharmeceutical spam pitch:

X-Spam-Status: Yes, hits=12.6 tagged_above=-999.0 required=5.0 tests=AWL,
 BANG_GUARANTEE, BAYES_99, DATE_IN_FUTURE_03_06, J_CHICKENPOX_28,
RCVD_IN_SBL,
 SARE_OBFUMONEY2, TW_NW
X-Spam-Level: ************
X-Spam-Flag: YES


The strange thing is when I copy this deformed email back to the Exchange
server (using IMAP), that Outlook then seems to decide that the X-Spam stuff
*is* part of the header after all and the Outlook client doesn't show the
X-Spam stuff in the body of the email... even though on initial delivery it
was in the body.... so not sure if this is a problem in SA, amavsd-new, or
Exchange/Outlook.

Pretty annoying to have SA properly tag something, but have it come through
anyway... I'm hoping someone else has seen this (I was unable to turn up
anything in the archives).

thanks!

johnS

RE: Headers with extra whitespace missing filters in Exchange/Outlook ?

[Bret Miller <br...@wcg.org>]

> We're running SpamAssassin 2.63 with amavisd-new-20030616-p5 
> and postfix as
> a frontend to our Exchange server (yes, it all needs to be 
> updated, but
> still working damn well). SA/amavisd-new tags all mail with 
> scores (dropping
> stuff with scores over 20), and it's up to Exchange rules to 
> filter to Spam
> folders for the end users.
> 
> A few months ago I started to see an occasional email come 
> through to the
> client with the X-Spam headers showing up in the body of the 
> email rather
> than the header (and since the rules trigger on the header, 
> not getting
> filtered as spam by the client rules).
> 
> Attached is an example of one of these emails. It appears 
> that there is a
> space between the original header and the X-Spam headers, 
> which I think is
> what is causing the client to consider the space to mark the 
> beginning of
> the body.
> 
> Anyone seen this? The email shows up in the Outlook client 
> with this at the
> top, followed by the pharmeceutical spam pitch:

When we were running Merak for a evaluation, I saw this occasionally.
What happens is that some spam engine must insert an extra CR without
the LF following which apparently most e-mail servers ignore. But in
parsing the headers for rules, some servers see CR-CR-LF as the end of
the headers and ignore the remaining headers. In my case, the app
calling SpamAssassin was my own, so I simply coded it to drop extra CR
characters which then made it perform correctly.


> 
> X-Spam-Status: Yes, hits=12.6 tagged_above=-999.0 
> required=5.0 tests=AWL,
>  BANG_GUARANTEE, BAYES_99, DATE_IN_FUTURE_03_06, J_CHICKENPOX_28,
> RCVD_IN_SBL,
>  SARE_OBFUMONEY2, TW_NW
> X-Spam-Level: ************
> X-Spam-Flag: YES
> 
> 
> The strange thing is when I copy this deformed email back to 
> the Exchange
> server (using IMAP), that Outlook then seems to decide that 
> the X-Spam stuff
> *is* part of the header after all and the Outlook client 
> doesn't show the
> X-Spam stuff in the body of the email... even though on 
> initial delivery it
> was in the body.... so not sure if this is a problem in SA, 
> amavsd-new, or
> Exchange/Outlook.
> 
> Pretty annoying to have SA properly tag something, but have 
> it come through
> anyway... I'm hoping someone else has seen this (I was unable 
> to turn up anything in the archives).


Bret