Whilst upgrading my qmail-scanner installation to 1.12 recently I decided to
check the quarantine-attachments.txt file and found the line:
.{100,} Virus-Date: Date Buffer Overflow trojan
had been replace with the following:
.{100,} Virus-Date: MIME Header Buffer Overflow
.{100,} Virus-Mime-Version: MIME Header Buffer Overflow
.{100,} Virus-Resent-Date: MIME Header Buffer Overflow
so I decided to change my config.
After updating the file, I tried to generate a new db file and got.
qmail-scanner-queue.pl -g
perlscanner: generate new DB file
perlscannner: total of 139 entries.
qmail-scanner-queue.pl -r
perlscanner: reading from /var/spool/qmailscan/quarantine-attachments.db
...skipped...
perlscanner: total of 137 entries found.
Only one of the three lines entries was listed. Playing about with the order
of the lines, the last entry was always the one actually stored.
I had a quick look at the generate_quarantine_db code, and the problem is (I
think) because the three items above have the same regex. It looks like they
are read into the array correctly, but when they are written to the file,
the
last one added overwrites the previous one. I know very little about the
internals of DB_File and Berkeley DB, so decided that anything I did to try
and fix it would break more than it fixed.
As a work around I have changed it to:
.{99,} Virus-Date: MIME Header Buffer Overflow
.{100,} Virus-Mime-Version: MIME Header Buffer Overflow
.{101,} Virus-Resent-Date: MIME Header Buffer Overflow
which works fine.
Environment
Redhat 6.2 with all errata applied.
Perl 5.005_03
Tried both DB_File 1.803 and 1.804
as far as I can tell DB_File is built using /usr/lib/libdb.a from
glibc-devel-2.1.3-23
Could someone with a bit more knowledge shed some light on this?
Thanks,
Chris Hine
---
Technical Support
Océ (UK) Ltd.
Langston Road
Loughton
Essex
Telephone: 020-8498 6020
Fax: 020-8498 6390
**********************************
Océ (UK) Ltd does not accept any contractual or other legal
liability for the contents of this e-mail and any attachments.
They are confidential to the addressee. Unauthorised access
and use is prohibited.
**********************************
Registered office: Langston Road, Loughton, Essex IG10 3SL.
Registered in England No 235241
Ultimate holding company: Océ N.V, Venlo, The Netherlands
_______________________________________________________________
Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -
http://devcon.sprintpcs.com/adp/index.cfm?source=osdntextlink
_______________________________________________
Qmail-scanner-general mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
