Bug 2262 - RatWare: Evaluation copy of LSMTP(TM)
Summary: RatWare: Evaluation copy of LSMTP(TM)
Status: RESOLVED WONTFIX
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: Rules (show other bugs)
Version: unspecified
Hardware: Other other
: P5 normal
Target Milestone: Future
Assignee: SpamAssassin Developer Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-07-25 17:10 UTC by Simon Lyall
Modified: 2011-05-02 12:46 UTC (History)
1 user (show)


Attachment Type Modified Status Actions Submitter/CLA Status
Sample Spam from mailer text/plain None Simon Lyall [NoCLA]
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Simon Lyall 2003-07-25 17:10:57 UTC 
Got a little Spam just now that appears to have been sent using an evaluation
copy of the LSMTP mail server. The software nicely tags that it's an evaluation
copy via these comment lines:

Comments: This message was delivered by an evaluation copy of LSMTP(TM)
Comments: running on gauss.supersiteler.com. L-Soft did not author, review 
Comments: nor edit the present message and therefore assumes no
Comments: responsibility for its content. LSMTP evaluation kits are made
Comments: available for testing purposes, on the assumption that they will
Comments: only be used to deliver information requested by its recipients.

I would doubt that many people would be using the evaluation version to send
much ham so this should be a fairly safe rule. Not sure how common it is for
spammers to us it though. I'll attach the full copy of my spam.

Suggested rule:

header RATWARE_EVAL_LSMTP           Comments =~ /evaluation copy of LSMTP/
describe RATWARE_EVAL_LSMTP         Bulk email software fingerprint (Evaluation
LSMTP) found in headers
Comment 1 Simon Lyall 2003-07-25 17:12:08 UTC 
Created attachment 1186 [details]
Sample Spam from mailer
Comment 2 Daniel Quinlan 2005-03-30 01:09:13 UTC 
move bug to Future milestone (previously set to Future -- I hope)
Comment 3 Henrik Krohns 2011-05-02 12:46:08 UTC 
Closing obsolete bug.