Forged outlook headers with outlook

[Rolf <ro...@ses.tas.gov.au>]

hello

Using SA 3.0.4

I have been receiving false positives with the rule FORGED_MUA_OUTLOOK 
being added to email that is sent from Outlook 6 (2003?).

Have looked in the archives and the only suggestion is to set the score 
to zero;  which defeats the idea surely.

Is there something wrong with the rule such that messages from Outlook 
appear to have forged headers when in fact Outlook did generate them?
Is the rule correct and perhaps somehow the headers of the mail have 
been altered in transit to trigger the rule?

Suggestions appreciated.

thanks

rolf.

Re: Forged outlook headers with outlook

[Rolf <ro...@ses.tas.gov.au>]

> I think the last time this happened had something to do with the 
> received
> headers in the message, if I recall correctly.  There was a fix for an
> instance of this fairly recently, but I don't recall the details.  The 
> fix
> may have been in the 3.1 stream.

Thank you.

I have 3.0.4 here and no particularly convenient way to look at 3.1.  
If 3.1 does contain the fix would someone be able to post or send the 
relevant lines of the rules? I'd love to incorporate them in the local 
config here.

cheers

rolf.

Re: Forged outlook headers with outlook

[Loren Wilton <lw...@earthlink.net>]

I think the last time this happened had something to do with the received
headers in the message, if I recall correctly.  There was a fix for an
instance of this fairly recently, but I don't recall the details.  The fix
may have been in the 3.1 stream.

        Loren