RE: Headers with extra whitespace missing filters in Exchange/Outlook ?

[Bret Miller <br...@wcg.org>]

> We're running SpamAssassin 2.63 with amavisd-new-20030616-p5 
> and postfix as
> a frontend to our Exchange server (yes, it all needs to be 
> updated, but
> still working damn well). SA/amavisd-new tags all mail with 
> scores (dropping
> stuff with scores over 20), and it's up to Exchange rules to 
> filter to Spam
> folders for the end users.
> 
> A few months ago I started to see an occasional email come 
> through to the
> client with the X-Spam headers showing up in the body of the 
> email rather
> than the header (and since the rules trigger on the header, 
> not getting
> filtered as spam by the client rules).
> 
> Attached is an example of one of these emails. It appears 
> that there is a
> space between the original header and the X-Spam headers, 
> which I think is
> what is causing the client to consider the space to mark the 
> beginning of
> the body.
> 
> Anyone seen this? The email shows up in the Outlook client 
> with this at the
> top, followed by the pharmeceutical spam pitch:

When we were running Merak for a evaluation, I saw this occasionally.
What happens is that some spam engine must insert an extra CR without
the LF following which apparently most e-mail servers ignore. But in
parsing the headers for rules, some servers see CR-CR-LF as the end of
the headers and ignore the remaining headers. In my case, the app
calling SpamAssassin was my own, so I simply coded it to drop extra CR
characters which then made it perform correctly.


> 
> X-Spam-Status: Yes, hits=12.6 tagged_above=-999.0 
> required=5.0 tests=AWL,
>  BANG_GUARANTEE, BAYES_99, DATE_IN_FUTURE_03_06, J_CHICKENPOX_28,
> RCVD_IN_SBL,
>  SARE_OBFUMONEY2, TW_NW
> X-Spam-Level: ************
> X-Spam-Flag: YES
> 
> 
> The strange thing is when I copy this deformed email back to 
> the Exchange
> server (using IMAP), that Outlook then seems to decide that 
> the X-Spam stuff
> *is* part of the header after all and the Outlook client 
> doesn't show the
> X-Spam stuff in the body of the email... even though on 
> initial delivery it
> was in the body.... so not sure if this is a problem in SA, 
> amavsd-new, or
> Exchange/Outlook.
> 
> Pretty annoying to have SA properly tag something, but have 
> it come through
> anyway... I'm hoping someone else has seen this (I was unable 
> to turn up anything in the archives).


Bret