[______TOC_______] [NEXT CHAPTER]
	FML Security Advisory 2000-003: Love Letter Worm
	========================================

Topic:	Love Letter Worm

			Ken'ichi Fukamachi <fukachan@sapporo.iij.ad.jp>

	Copyright (C) 2000 Ken'ichi Fukamachi
		All rights reserved.

[Abstract] 
   * add the rule to config.ph

   &DEFINE_FIELD_PAT_TO_REJECT("Subject", "ILOVEYOU");

   $DISTRIBUTE_FILTER_HOOK = q#
      if ($e{'Body'} =~ /Content.*\.vbs|filename=.*\.vbs/i) {
           return 'VB script attatchment';
      }
   #;

   &ADD_CONTENT_HANDLER('multipart/.*', '.*/.*', 'reject');

[References]
  "CERT Advisory CA-2000-04 Love Letter Worm"
http://www.cert.org/advisories/CA-2000-04.html 

http://www.f-secure.com/v-descs/love.htm 
http://www.sophos.com/virusinfo/analyses/vbsloveleta.html 
http://www.sophos.com/virusinfo/analyses/trojloveleta.html 
http://www.thepope.org/index.pl?node_id=140 
http://www.datafellows.com/v-descs/love.htm 
http://www.symantec.com/avcenter/venc/data/vbs.loveletter.a.html 


-------------------------
  • 1 Love Letter Worn
  • 1.1 original Love Letter
  • 1.2 Variant 1
  • 1.3 Variant 2
  • I Filtering


  • 2 Filtering Function
  • 2.1 FML Filtering
  • 2.2 use "makefml config"
  • 2.3 write cf
  • 2.4 write config.ph
  • 2.5 make secure
  • 3 Add a new filtering rule
  • 3.1 cf
  • 3.2 config.ph
  • 3.3 reject every MIME Multipart mails
  • 4 other solutions
  • 4.1 vf.exe
  • Appendix A.1 Bugtraq
  • Appendix A.2 postfix filtering
  • Appendix A.3 sendmail
  • Appendix A.4 uuencoded ? ------------------------- See INSTALL manual for more details on how to configure fml. http://www.fml.org/fml/INSTALL/ "CERT Advisory CA-2000-04 Love Letter Worm" [______TOC_______] [NEXT CHAPTER]
    Copyright (C) 1993-2000 Ken'ichi Fukamachi
    All rights of this page is reserved.
    
    # This Document(html format) is automatically geneareted by fwix.pl. 
    # fwix (Formatter of WIX Language) is fml document formatter system
    # designed to generate plaintext, html, texinfo and nroff from one file.