[______TOC_______]
[NEXT CHAPTER]
FML Security Advisory 2000-003: Love Letter Worm
========================================
Topic: Love Letter Worm
Ken'ichi Fukamachi <fukachan@sapporo.iij.ad.jp>
Copyright (C) 2000 Ken'ichi Fukamachi
All rights reserved.
[Abstract]
* add the rule to config.ph
&DEFINE_FIELD_PAT_TO_REJECT("Subject", "ILOVEYOU");
$DISTRIBUTE_FILTER_HOOK = q#
if ($e{'Body'} =~ /Content.*\.vbs|filename=.*\.vbs/i) {
return 'VB script attatchment';
}
#;
&ADD_CONTENT_HANDLER('multipart/.*', '.*/.*', 'reject');
[References]
"CERT Advisory CA-2000-04 Love Letter Worm"
http://www.cert.org/advisories/CA-2000-04.html
http://www.f-secure.com/v-descs/love.htm
http://www.sophos.com/virusinfo/analyses/vbsloveleta.html
http://www.sophos.com/virusinfo/analyses/trojloveleta.html
http://www.thepope.org/index.pl?node_id=140
http://www.datafellows.com/v-descs/love.htm
http://www.symantec.com/avcenter/venc/data/vbs.loveletter.a.html
-------------------------
1 Love Letter Worn
1.1 original Love Letter
1.2 Variant 1
1.3 Variant 2
2 Filtering Function
2.1 FML Filtering
2.2 use "makefml config"
2.3 write cf
2.4 write config.ph
2.5 make secure
3 Add a new filtering rule
3.1 cf
3.2 config.ph
3.3 reject every MIME Multipart mails
4 other solutions
4.1 vf.exe
Appendix A.1 Bugtraq
Appendix A.2 postfix filtering
Appendix A.3 sendmail
Appendix A.4 uuencoded ?
-------------------------
See INSTALL manual for more details on how to configure fml.
http://www.fml.org/fml/INSTALL/
"CERT Advisory CA-2000-04 Love Letter Worm"
[______TOC_______]
[NEXT CHAPTER]
Copyright (C) 1993-2000 Ken'ichi Fukamachi
All rights of this page is reserved.
# This Document(html format) is automatically geneareted by fwix.pl.
# fwix (Formatter of WIX Language) is fml document formatter system
# designed to generate plaintext, html, texinfo and nroff from one file.