spam with image/gif doesn't show a rule for "image"

[cr...@animalhead.com]

Hi SA users,

We're receiving leaked spam that has one gif image in each.  In such  
emails,
the SA status line doesn't show a rule match for an image.  Here's a  
sample:

No, score=3.0 required=5.0 tests=EXTRA_MPART_TYPE,HTML_MESSAGE   
autolearn=no version=3.1.7

Looking at the source for the email with that status line, it  
contains a MIME
header like this:

------=_NextPart_751_0238_74D66A10.EB28167E
Content-Type: image/gif;
	name="aedvi.gif"
Content-Transfer-Encoding: base64

Shouldn't SA notice this image and show an image item in its status  
line?
If so, is this a known problem and is there a fix available?

Thanks for your consideration,
Craig MacKenna
www.animalhead.com
Los Gatos, CA

Re: spam with image/gif doesn't show a rule for "image"

[Theo Van Dinter <fe...@apache.org>]

On Mon, Feb 26, 2007 at 04:42:36PM -0800, craig@animalhead.com wrote:
> No, score=3.0 required=5.0 tests=EXTRA_MPART_TYPE,HTML_MESSAGE   
> autolearn=no version=3.1.7
> 
> Shouldn't SA notice this image and show an image item in its status  
> line?

Do you have a rule that looks for an image attachment?  If not, then no.

-- 
Randomly Selected Tagline:
To err is human,
 To purr feline.
 		-- Robert Byrne