You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by do...@apache.org on 2006/09/02 22:53:46 UTC
svn commit: r439650 - /spamassassin/rules/trunk/sandbox/dos/70_other.cf
Author: dos
Date: Sat Sep 2 13:53:46 2006
New Revision: 439650
URL: http://svn.apache.org/viewvc?rev=439650&view=rev
Log:
sandbox: catch bogus SquirrelMail headers
Modified:
spamassassin/rules/trunk/sandbox/dos/70_other.cf
Modified: spamassassin/rules/trunk/sandbox/dos/70_other.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/dos/70_other.cf?rev=439650&r1=439649&r2=439650&view=diff
==============================================================================
--- spamassassin/rules/trunk/sandbox/dos/70_other.cf (original)
+++ spamassassin/rules/trunk/sandbox/dos/70_other.cf Sat Sep 2 13:53:46 2006
@@ -50,3 +50,14 @@
describe DOS_STOCK_O_PRICE Stocks with 'oh', rather than 'zero' values
+# http://www.squirrelmail.org/docs/user/user-3.html#ss3.1
+# mids: 1123.145.23.250.17.squirrel@webserveraddress
+header __DOS_UA_SM User-Agent =~ /SquirrelMail/
+header __DOS_MAILER_SM X-Mailer =~ /SquirrelMail/
+header __DOS_RELAY_SM Received =~ /SquirrelMail authenticated/
+header __DOS_SM_MID Message-ID ~/^\d{4}\.\d{3}\.\d{2}\.\d{3}\.\d{2}\.squirrel\@[A-Za-z0-9._-]+/
+
+meta DOS_FAKE_SQUIRREL (__DOS_UA_SM || __DOS_MAILER_SM) && (!__DO_RELAY_SM || !__DOS_SM_MID)
+describe DOS_FAKE_SQUIRREL Message contains faked SquirrelMail headers
+
+