You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Paolo Cravero as2594 <pc...@as2594.net> on 2005/09/20 11:03:48 UTC
SA 3.1 false positive on FORGED_MUA_OUTLOOK
Hi,
just incurred in a false positive with SA 3.1 (through amavisd-new).
The message comes from a friend, and he uses a real Outlook Express
client, perhaps the Italian version.
libero.it is one of the biggest Italian (free) ISPs.
Any hint on fixing this?
Paolo
.............................
Received: from localhost (172.16.1.84) by smtp2.libero.it (7.0.027-DD01)
id 431C3A2400E8EB94; Mon, 19 Sep 2005 19:44:51 +0200
Received: from smtp0.libero.it ([172.16.1.76])
by localhost (asav5.libero.it [193.70.192.154]) (amavisd-new, port 10024)
with ESMTP id 11243-11-5; Mon, 19 Sep 2005 19:44:50 +0200 (CEST)
Received: from Vecchio (195.210.65.40) by smtp0.libero.it (7.0.027-DD01)
id 431C393500235EBE; Mon, 19 Sep 2005 19:44:50 +0200
Received: from ppp-231-174.25-151.libero.it
(USER_ANONYMOUS@ppp-xxx-174.25-151.libero.it [151.25.174.xxx])
by wca20.libero.it (SlipStream SP Server 4.0.112
built 2005/05/06 17:01:26 -0400 (EDT)); Mon, 19 Sep 2005 19:44:50 +0200
(CEST)
X-Originating-IP: [151.25.174.xxx]
X-Originating-User: [USER_ANONYMOUS]
Message-ID:
<US...@Vecchio>
From: "Name Surname" <GO...@libero.it>
To: "Name Surname" <co...@email.address>,
"Name Surname" <co...@email.address>
Subject: cinema
Date: Mon, 19 Sep 2005 19:43:12 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0056_01C5BD52.5F07C5C0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Scanned: with antispam and antivirus automated system at libero.it
X-Spam-Status: Yes, hits=4.924 tag=-999 tag2=3.5 kill=3.5
tests=[BAYES_00=-2.599, DNS_FROM_RFC_ABUSE=0.2, NS_FROM_RFC_POST=1.708,
FORGED_MUA_OUTLOOK=4.056, HTML_MESSAGE=0.001,
RCVD_IN_BL_SPAMCOP_NET=1.558]
X-Spam-Score: 4.924
X-Spam-Level: ****
X-Spam-Flag: YES
Re[2]: make test errors
Posted by virt <vi...@tut.by>.
Problem is solved after i downgrade MySQL 4.1.14 to MySQL 4.0.26
> May be that help you for answer..
> make test TEST_VERBOSE=1 TEST_FILES="./t/bayessql.t"
> PERL_DL_NONLAZY=1 /usr/local/bin/perl5.6.1
> "-MExtUtils::Command::MM" "-e" "test_harness(1, 'blib/lib',
> 'blib/arch')" ./t/bayessql.t
> ./t/bayessql....1..53
> ok 1
> ok 2
> ...
> ok 25
> not ok 26
> # Failed test 26 in ./t/bayessql.t at line 188
> ok 27
> ..
> ok 32
> not ok 33
> # Failed test 33 in ./t/bayessql.t at line 223
> ok 34
> ..
> ok 39
> /usr/local/bin/perl5.6.1 -T -w ../sa-learn -C
> log/test_rules_copy --siteconfigpath log/localrules.tmp -p
> log/test_default.cf --spam data/spam
> ok 40
> Checking Acted on message
> ok 41
> /usr/local/bin/perl5.6.1 -T -w ../sa-learn -C
> log/test_rules_copy --siteconfigpath log/localrules.tmp -p
> log/test_default.cf --ham data/nice
> ok 42
> Checking Acted on message
> ok 43
> /usr/local/bin/perl5.6.1 -T -w ../sa-learn -C
> log/test_rules_copy --siteconfigpath log/localrules.tmp -p
> log/test_default.cf --ham
> data/whitelists
> ok 44
> Checking Acted on message
> ok 45
> /usr/local/bin/perl5.6.1 -T -w ../sa-learn -C
> log/test_rules_copy --siteconfigpath log/localrules.tmp -p
> log/test_default.cf --dump magic
> ok 46
> Checking db version
> ok 47
> ok 48
> Use of uninitialized value in concatenation (.) or string at ./t/bayessql.t line 314.
> returned score:
> Use of uninitialized value in pattern match (m//) at ./t/bayessql.t line 315.
> not ok 49
> # Failed test 49 in ./t/bayessql.t at line 315
> Use of uninitialized value in concatenation (.) or string at ./t/bayessql.t line 343.
> returned score:
> Use of uninitialized value in pattern match (m//) at ./t/bayessql.t line 344.
> not ok 50
> # Failed test 50 in ./t/bayessql.t at line 344
> ok 51
> ok 52
> ok 53
> FAILED tests 26, 33, 49-50
> Failed 4/53 tests, 92.45% okay
> Failed Test Stat Wstat Total Fail Failed List of Failed
>> Good Day!
>> I use:
>> FreeBSD 4.11p11
>> Perl 5.6.1
>> make test TEST_FILES="./t/bayessql.t"
>> PERL_DL_NONLAZY=1 /usr/local/bin/perl5.6.1
>> "-MExtUtils::Command::MM" "-e" "test_
>> harness(0, 'blib/lib', 'blib/arch')" ./t/bayessql.t
>> ./t/bayessql....ok 48/53Use of uninitialized value in concatenation (.) or strin
>> g at ./t/bayessql.t line 314.
>> Use of uninitialized value in pattern match (m//) at ./t/bayessql.t line 315.
>> ./t/bayessql....NOK 49Use of uninitialized value in concatenation (.) or string
>> at ./t/bayessql.t line 343.
>> Use of uninitialized value in pattern match (m//) at ./t/bayessql.t line 344.
>> ./t/bayessql....FAILED tests 26, 33, 49-50
>> Failed 4/53 tests, 92.45% okay
>> Failed Test Stat Wstat Total Fail Failed List of Failed
>> -------------------------------------------------------------------------------
>> ./t/bayessql.t 53 4 7.55% 26 33 49-50
>> Failed 1/1 test scripts, 0.00% okay. 4/53 subtests failed, 92.45% okay.
>> *** Error code 35
>> Stop in
>> /usr/ports/mail/p5-Mail-SpamAssassin/work/Mail-SpamAssassin-3.1.0.
>> What wrong?
>> Alexandr
Re: make test errors
Posted by virt <vi...@tut.by>.
May be that help you for answer..
make test TEST_VERBOSE=1 TEST_FILES="./t/bayessql.t"
PERL_DL_NONLAZY=1 /usr/local/bin/perl5.6.1 "-MExtUtils::Command::MM" "-e" "test_harness(1, 'blib/lib', 'blib/arch')" ./t/bayessql.t
./t/bayessql....1..53
ok 1
ok 2
...
ok 25
not ok 26
# Failed test 26 in ./t/bayessql.t at line 188
ok 27
..
ok 32
not ok 33
# Failed test 33 in ./t/bayessql.t at line 223
ok 34
..
ok 39
/usr/local/bin/perl5.6.1 -T -w ../sa-learn -C log/test_rules_copy --siteconfigpath log/localrules.tmp -p log/test_default.cf --spam data/spam
ok 40
Checking Acted on message
ok 41
/usr/local/bin/perl5.6.1 -T -w ../sa-learn -C log/test_rules_copy --siteconfigpath log/localrules.tmp -p log/test_default.cf --ham data/nice
ok 42
Checking Acted on message
ok 43
/usr/local/bin/perl5.6.1 -T -w ../sa-learn -C log/test_rules_copy --siteconfigpath log/localrules.tmp -p log/test_default.cf --ham
data/whitelists
ok 44
Checking Acted on message
ok 45
/usr/local/bin/perl5.6.1 -T -w ../sa-learn -C log/test_rules_copy --siteconfigpath log/localrules.tmp -p log/test_default.cf --dump magic
ok 46
Checking db version
ok 47
ok 48
Use of uninitialized value in concatenation (.) or string at ./t/bayessql.t line 314.
returned score:
Use of uninitialized value in pattern match (m//) at ./t/bayessql.t line 315.
not ok 49
# Failed test 49 in ./t/bayessql.t at line 315
Use of uninitialized value in concatenation (.) or string at ./t/bayessql.t line 343.
returned score:
Use of uninitialized value in pattern match (m//) at ./t/bayessql.t line 344.
not ok 50
# Failed test 50 in ./t/bayessql.t at line 344
ok 51
ok 52
ok 53
FAILED tests 26, 33, 49-50
Failed 4/53 tests, 92.45% okay
Failed Test Stat Wstat Total Fail Failed List of Failed
> Good Day!
> I use:
> FreeBSD 4.11p11
> Perl 5.6.1
> make test TEST_FILES="./t/bayessql.t"
> PERL_DL_NONLAZY=1 /usr/local/bin/perl5.6.1
> "-MExtUtils::Command::MM" "-e" "test_
> harness(0, 'blib/lib', 'blib/arch')" ./t/bayessql.t
> ./t/bayessql....ok 48/53Use of uninitialized value in concatenation (.) or strin
> g at ./t/bayessql.t line 314.
> Use of uninitialized value in pattern match (m//) at ./t/bayessql.t line 315.
> ./t/bayessql....NOK 49Use of uninitialized value in concatenation (.) or string
> at ./t/bayessql.t line 343.
> Use of uninitialized value in pattern match (m//) at ./t/bayessql.t line 344.
> ./t/bayessql....FAILED tests 26, 33, 49-50
> Failed 4/53 tests, 92.45% okay
> Failed Test Stat Wstat Total Fail Failed List of Failed
> -------------------------------------------------------------------------------
> ./t/bayessql.t 53 4 7.55% 26 33 49-50
> Failed 1/1 test scripts, 0.00% okay. 4/53 subtests failed, 92.45% okay.
> *** Error code 35
> Stop in
> /usr/ports/mail/p5-Mail-SpamAssassin/work/Mail-SpamAssassin-3.1.0.
> What wrong?
> Alexandr
make test errors
Posted by virt <vi...@tut.by>.
Good Day!
I use:
FreeBSD 4.11p11
Perl 5.6.1
make test TEST_FILES="./t/bayessql.t"
PERL_DL_NONLAZY=1 /usr/local/bin/perl5.6.1 "-MExtUtils::Command::MM" "-e" "test_
harness(0, 'blib/lib', 'blib/arch')" ./t/bayessql.t
./t/bayessql....ok 48/53Use of uninitialized value in concatenation (.) or strin
g at ./t/bayessql.t line 314.
Use of uninitialized value in pattern match (m//) at ./t/bayessql.t line 315.
./t/bayessql....NOK 49Use of uninitialized value in concatenation (.) or string
at ./t/bayessql.t line 343.
Use of uninitialized value in pattern match (m//) at ./t/bayessql.t line 344.
./t/bayessql....FAILED tests 26, 33, 49-50
Failed 4/53 tests, 92.45% okay
Failed Test Stat Wstat Total Fail Failed List of Failed
-------------------------------------------------------------------------------
./t/bayessql.t 53 4 7.55% 26 33 49-50
Failed 1/1 test scripts, 0.00% okay. 4/53 subtests failed, 92.45% okay.
*** Error code 35
Stop in /usr/ports/mail/p5-Mail-SpamAssassin/work/Mail-SpamAssassin-3.1.0.
What wrong?
Alexandr
Re: SA 3.1 false positive on FORGED_MUA_OUTLOOK
Posted by Rolf <ro...@ses.tas.gov.au>.
> On Dienstag, 20. September 2005 11:03 Paolo Cravero as2594 wrote:
>> X-Spam-Status: Yes, hits=4.924 tag=-999 tag2=3.5 kill=3.5
>> tests=[BAYES_00=-2.599, DNS_FROM_RFC_ABUSE=0.2,
>> NS_FROM_RFC_POST=1.708, FORGED_MUA_OUTLOOK=4.056, HTML_MESSAGE=0.001,
>> RCVD_IN_BL_SPAMCOP_NET=1.558]
>> X-Spam-Score: 4.924
>
>> Any hint on fixing this?
>
> Yes, increase the level at which an e-mail is marked as SPAM. This one
> got only 4.924 points, which is still below the default 5 points
It would be marked as spam by me. But only just.
> Maybe an update to his Outlook Express could help, saves 4.056 points
> if
> his e-mail program works correctly :-)
I think Outlook 6 does work correctly. I think the rules for
FORGED_MUA_OUTLOOK are faulty. I have set the score for that rule to
zero until the test is a little more meaningful. A previous comment
about this rule indicated that it was possibly fixed in 3.1 ...
r.
> mfg zmi
> --
> // Michael Monnerie, Ing.BSc --- it-management Michael Monnerie
> // http://zmi.at Tel: 0660/4156531 Linux 2.6.11
> // PGP Key: "lynx -source http://zmi.at/zmi2.asc | gpg --import"
> // Fingerprint: EB93 ED8A 1DCD BB6C F952 F7F4 3911 B933 7054 5879
> // Keyserver: www.keyserver.net Key-ID: 0x70545879
Tasmania Together 5 Year Review: Have your say : http://www.tasmaniatogether.tas.gov.au.
Re: SA 3.1 false positive on FORGED_MUA_OUTLOOK
Posted by Paolo Cravero as2594 <pc...@as2594.net>.
Michael Monnerie wrote:
>>X-Spam-Status: Yes, hits=4.924 tag=-999 tag2=3.5 kill=3.5
>> tests=[BAYES_00=-2.599, DNS_FROM_RFC_ABUSE=0.2,
>>NS_FROM_RFC_POST=1.708, FORGED_MUA_OUTLOOK=4.056, HTML_MESSAGE=0.001,
>>RCVD_IN_BL_SPAMCOP_NET=1.558]
>>X-Spam-Score: 4.924
> Yes, increase the level at which an e-mail is marked as SPAM. This one
> got only 4.924 points, which is still below the default 5 points from
> where it should be marked as SPAM. A level of 3.5 is very optimistic,
> leading to lots of FP.
I work for an ISP and we've been running SA 2.64 at 3.5 threshold for a
couple of years now. All false positives so far have been well beyond
the threshold and mailing lists. Today's FP on SA 3.1 under evaluation
was a personal mail.
> Maybe an update to his Outlook Express could help, saves 4.056 points if
> his e-mail program works correctly :-)
Well, altought I can suggest it to my friend (who uses a 56k dialup
BTW), I can't force the whole world to update their OE clients (they'd
better switch to something better, anyway!).
Even if we increase the threshold to 5, what about false positives that
hit both FORGED_MUA_OUTLOOK and BAYES_nm (with nm leading a >1 score).
IMHO FORGED_MUA_OUTLOOK is buggy, but I have too few experience with
Outlook Express Message-IDs.
Paolo
--
| QRPp-I #707 + www.paolocravero.tk + I QRP #476 |
| SpamAssassin-based email antispam/antivirus solutions |
\ Italian/English-to/from-Croatian translations /
\ Skype: pcravero /
Re: SA 3.1 false positive on FORGED_MUA_OUTLOOK
Posted by Michael Monnerie <m....@zmi.at>.
On Dienstag, 20. September 2005 11:03 Paolo Cravero as2594 wrote:
> X-Spam-Status: Yes, hits=4.924 tag=-999 tag2=3.5 kill=3.5
> tests=[BAYES_00=-2.599, DNS_FROM_RFC_ABUSE=0.2,
> NS_FROM_RFC_POST=1.708, FORGED_MUA_OUTLOOK=4.056, HTML_MESSAGE=0.001,
> RCVD_IN_BL_SPAMCOP_NET=1.558]
> X-Spam-Score: 4.924
> Any hint on fixing this?
Yes, increase the level at which an e-mail is marked as SPAM. This one
got only 4.924 points, which is still below the default 5 points from
where it should be marked as SPAM. A level of 3.5 is very optimistic,
leading to lots of FP.
Maybe an update to his Outlook Express could help, saves 4.056 points if
his e-mail program works correctly :-)
mfg zmi
--
// Michael Monnerie, Ing.BSc --- it-management Michael Monnerie
// http://zmi.at Tel: 0660/4156531 Linux 2.6.11
// PGP Key: "lynx -source http://zmi.at/zmi2.asc | gpg --import"
// Fingerprint: EB93 ED8A 1DCD BB6C F952 F7F4 3911 B933 7054 5879
// Keyserver: www.keyserver.net Key-ID: 0x70545879