You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by gb...@apache.org on 2018/03/22 18:17:40 UTC
svn commit: r1827520 - /spamassassin/trunk/rules/20_ratware.cf
Author: gbechis
Date: Thu Mar 22 18:17:39 2018
New Revision: 1827520
URL: http://svn.apache.org/viewvc?rev=1827520&view=rev
Log:
detect an obviously fake Outlook X-Mailer
bz 7567
Modified:
spamassassin/trunk/rules/20_ratware.cf
Modified: spamassassin/trunk/rules/20_ratware.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rules/20_ratware.cf?rev=1827520&r1=1827519&r2=1827520&view=diff
==============================================================================
--- spamassassin/trunk/rules/20_ratware.cf (original)
+++ spamassassin/trunk/rules/20_ratware.cf Thu Mar 22 18:17:39 2018
@@ -85,12 +85,15 @@ header __OUTLOOK_DOLLARS_OTHER MESSAGEID
meta __FORGED_OUTLOOK_DOLLARS (__OUTLOOK_DOLLARS_MUA && !__OE_MSGID_2 && !__OUTLOOK_DOLLARS_OTHER && !__VISTA_MSGID && !__IMS_MSGID && !__UNUSABLE_MSGID)
# use new meta rules to implement FORGED_MUA_OUTLOOK rule from 2.60
+# bug 7567: obviously fake Outlook X-Mailer
+header __OUTLOOK_FAKE_MUA X-Mailer =~ /^Outlook$/
+
# bug 5496: avoid some FPs
header __FMO_EXCL_O3416 X-Mailer =~ /^Microsoft Outlook, Build 10.0.3416$/
header __FMO_EXCL_OE3790 X-Mailer =~ /^Microsoft Outlook Express 6.00.3790.3959$/
# bug 5910: __VISTA_MSGID also now used by Outlook Express from XP SP3
#
-meta FORGED_MUA_OUTLOOK ((__FORGED_OE || __FORGED_OUTLOOK_DOLLARS) && !__FMO_EXCL_O3416 && !__FMO_EXCL_OE3790 && !__VISTA_MSGID)
+meta FORGED_MUA_OUTLOOK ((__FORGED_OE || __FORGED_OUTLOOK_DOLLARS || __OUTLOOK_FAKE_MUA) && !__FMO_EXCL_O3416 && !__FMO_EXCL_OE3790 && !__VISTA_MSGID)
describe FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
# Outlook IMO (Internet Mail Only)