Spamassassin behavior

[Alan Au <al...@yahoo.com>]

Hi all,
   
  In :
  http://wiki.apache.org/spamassassin/BayesInSpamAssassin, it is stated that : 
   
  It's OK to feed emails with Spamassassin markup into the sa-learn command -- sa-learn will ignore any standard Spamassassin headers, and if the original email has been encapsulated into an attachment it will decapsulate the email. In other words sa-learn will undo any changes which Spamassassin has done before learning the spam/ham character of the email.
   
   
   
  I would like to know that if we forward an email which is not classified as spam to Spamassassin for it to learn, the reported spam will be enclosed with my new header information like the sender. I would like to ask if the above quote are still valid for Spamassassin 2.6.3. Sorry, I should not ask this question. But, I really need to know about this as we are using this version of Spamassassin under Mdaemon.
   
   
  Many thanks!

  Alan 

		
---------------------------------
Relax. Yahoo! Mail virus scanning helps detect nasty viruses!

Re: Spamassassin behavior

[Matt Kettler <mk...@comcast.net>]

Alan Au wrote:
> Hi all,
>  
> In :
> http://wiki.apache.org/spamassassin/BayesInSpamAssassin, it is stated
> that :
>  
> It's OK to feed emails with Spamassassin markup into the sa-learn
> command -- sa-learn will ignore any standard Spamassassin headers, and
> if the original email has been encapsulated into an attachment it will
> decapsulate the email. In other words sa-learn will undo any changes
> which Spamassassin has done before learning the spam/ham character of
> the email.
>  
>  
>  
> I would like to know that if we forward an email which is not
> classified as spam to Spamassassin for it to learn, the reported spam
> will be enclosed with my new header information like the sender.
In short: No, you can't learn from forwarded email.

SpamAssassin learns from the headers of a message, as well as the body.
It needs the original headers.

SA can undo it's own markups, because it knows what it added, but
recovering the original headers and message body from a forwarded
message is impossible. When you forward mail, the client completely
destroys and replaces the headers. That's 100% unrecoverable because the
original information is no longer there.


Your mail client also re-encodes the body, and may drop whole mime
sections when you forward a message. This is very common if the message
is a multipart/alterative, the forward will drop the original text/plain
and create a new text/plain based on the content of the text/html
section. A lot of spam contains text/plain sections with different
content from the text/html section in a foolish attempt to create bayes
poison.



> I would like to ask if the above quote are still valid for
> Spamassassin 2.6.3. Sorry, I should not ask this question. But, I
> really need to know about this as we are using this version of
> Spamassassin under Mdaemon.
You really should not be using SA 2.63. It is vulnerable to a remotely
exploitable DOS attack. All someone needs to do is email you a malformed
message to exploit this.

If you're using a distro-package, check with your distribution's package
release notes to make sure they've backported the security fixes from
2.64. If you're using the official source, at minimum upgrade to 2.64 ASAP.