SA Bugzilla – Bug 723
base64 encoded spam gets past filter
Last modified: 2002-08-22 19:11:37 UTC
I've had two spams so far that encode the text of the message as base64. They do not get identified as spam by my installation of spamassassin. If I use metamail to decode the spam and feed that to spamassassin then it is identified properly as spam. Here's a complete example(there really is garbage in the Date: header): Delivered-To: davep@baloo.meduseld.net Received: from mail.attbi.com (204.127.202.7) by baloo.meduseld.net with POP3 for <davep@meduseld.net>; 20 Aug 2002 04:15:01 -0000 Return-Path: <liyf_pfqj_b_a_c@meduseld.net> Received: from mail3.godaddy.com ([63.241.136.243]) by sccrgwc04.attbi.com (InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP id <20020820040223.XWLX7866.sccrgwc04.attbi.com@mail3.godaddy.com> for <panariti@attbi.com>; Tue, 20 Aug 2002 04:02:23 +0000 Received: (qmail 14043 invoked by uid 508); 20 Aug 2002 04:01:25 -0000 Delivered-To: meduseld-net-davep@meduseld.net Received: (qmail 14041 invoked from network); 20 Aug 2002 04:01:25 -0000 Received: from unknown (HELO mailstore1.secureserver.net) (63.241.136.82) by mail3.secureserver.net with SMTP; 20 Aug 2002 04:01:25 -0000 Received: (qmail 21210 invoked from network); 20 Aug 2002 04:02:19 -0000 Received: from unknown (HELO bobos-server) (211.233.14.41) by mailstore1.secureserver.net with SMTP; 20 Aug 2002 04:02:19 -0000 From: "" <Peter> To: "davep" <davep@meduseld.net> Subject: Very Important! Date: Tue, 20 Aug 02 11:54:37 ´ëÇѹα¹ Ç¥Áؽà MIME-Version: 1.0 Content-Type: multipart/mixed;boundary= "---- =_NextPart_000_0099_C921044.5C31E1BB" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2462.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2462.0000 Message-Id: <20020820040223.XWLX7866.sccrgwc04.attbi.com@mail3.godaddy.com> ------=_NextPart_000_0099_C921044.5C31E1BB Content-Type: text/html Content-Transfer-Encoding: base64 LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS08YnI+VGhpcyBtZXNzYWdl IHdhcyBzZW50IGJ5IEV4cHJlc3MgRGlyZWN0IEVtYWlsIEJsYXN0ZXIgVjUuMSwgPGJyPnlv dSBjYW4gZG93bmxvYWQgaXQgZnJvbTogPGEgaHJlZj0iaHR0cDovL3d3dy5mYXN0YnVsa2Vt YWlsLmNvbSI+d3d3LmZhc3RidWxrZW1haWwuY29tPC9hPjxicj5FeHByZXNzIERpcmVjdCBF bWFpbCBCbGFzdGVyIGlzIGEgcG93ZXJmdWwgZW1haWwgbWFya2V0aW5nIHRvb2whITxicj4t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPGJyPjxicj5IaSBwYWxzLg0K DQpJIGhhdmUgcmVjZW50bHkgZm91bmQgYSBwcm9ncmFtIHRoYXQgcGF5cyB5b3UganVzdCBm b3Igc3VyZmluZyB0aGUgbmV0LiBZb3UgY2FuIGVhcm4gdXAgdG8gVVMkMC43MCBhbiBob3Vy LiBUaGlzIGlzIHRydWUhDQoNCkkgaGF2ZSBlYXJuZWQgbW9yZSB0aGFuIFVTJDIwMCsgYSBt b250aCBqdXN0IGJ5IHN1cmZpbmcgdGhlIG5ldC4gWW91IGNhbiBkbyB0aGUgc2FtZSB0b28u DQpJbnRlcm5hdGlvbmFsIHN1cmZlcnMgYXJlIHdlbGNvbWVkIHRvbyAhDQpEb24ndCBoZXNp dGF0ZSAuIEpvaW4gbm93ICENCg0KaHR0cDovL3d3dy5zcGVkaWEubmV0L2NnaS1iaW4vdHou Y2dpP3J1bj1zaG93X3N2YyZmbD04JnZpZD0zNDMxMzU5DQoNClJlZ2FyZHMsDQpwZXRlciAg ICA= ------=_NextPart_000_0099_C921044.5C31E1BB--
The Content-Type header looks interesting but I think there just sneaked a newline in when you copied & pasted. Can you please save that message to a file and _attach_ it to this bug report? (Click on "Create a new attachment" to do so.)
Created attachment 279 [details] actual copy of spam
Subject: Re: base64 encoded spam gets past filter >>>>> "anon" == bugzilla-daemon <bugzilla-daemon@hughes-family.org> writes: http> //www.hughes-family.org/bugzilla/show_bug.cgi?id=723 anon> ------- Additional Comments From anon> spamassassin-contrib@msquadrat.de 2002-08-20 09:11 anon> ------- anon> The Content-Type header looks interesting but I think there anon> just sneaked a newline in when you copied & pasted. Can you anon> please save that message to a file and _attach_ it to this anon> bug report? (Click on "Create a new attachment" to do so.) Done. There is no attach field on the submit a bug page. It seems like adding one would prevent a lot of unnecessary email traffic (like this one :-) davep -- An idea is not responsible for the people who believe in it.
I can't reproduce that behavior. Hmmm... which SA version do you use? There's no X-Spam-Status header in the mail. Is it possible that it never got processed? Here are the scores from the current versions: X-Spam-Status: Yes, hits=16.4 required=5.0 tests=FROM_MALFORMED,TO_LOCALPART_EQ_REAL,INVALID_DATE,PLING, DIRECT_EMAIL,EMAIL_MARKETING,RAZOR_CHECK,BASE64_ENC_TEXT, DATE_IN_FUTURE_06_12,RCVD_IN_RFCI version=2.31-mss2 X-Spam-Status: Yes, hits=15.0 required=5.0 tests=BASE64_ENC_TEXT,DATE_IN_FUTURE_06_12,DIRECT_EMAIL, EMAIL_MARKETING,EXPECT_TO_EARN,HEADER_8BITS,INVALID_DATE, MIME_HTML_NO_CHARSET,RAZOR_CHECK,RCVD_IN_RFCI, SPAM_PHRASE_02_03,USER_AGENT_OE version=2.40-cvs
Subject: Re: base64 encoded spam gets past filter SpamAssassin version 2.31 When I run thus: spamassassin -S -P -L -F0 -d <~/tmp/spam0 which is how my .procmailrc does, it *IS NOT* spam When I run like this: spamassassin -P -L <~/tmp/spam0 It *IS* spam My current set of options seems to work for other cases, and I think they are a legal combination. I just checked, it looks like the -F0 is causing it. I need that since the From line makes supercite complain about a non-compliant header line. Perhaps in addition to this bug, spamassassin and supercite should be made to play together? davep -- "I don't trust software that I have to pay for." -- davep
Maybe you should try it without the -d? :) | -d, --remove-markup Remove spam reports from a message
Subject: Re: base64 encoded spam gets past filter I made too many changes at once. But I could've sworn I've seen spam notices since I made them all. Perusal of +trash belies that. But the man page is misleading, IMO. To me it implied that it would only omit adding markup headers. I guess the note: (Note: the message will not be exactly identical; some headers will be reformatted due to some features of the Mail::Internet package, but the body text will be.) which was *EXACTLY* what I was looking for: body text unaltered but headers reformatted, threw me. No extra pages of why this thing was spam. I'm still getting used to spamassassin and still look at what it considers spam, especially since it has been way off in a few cases. My humblest apologies. But since `bug' can be interpreted as `feature' (as in that's not a bug that's a feature, which in this case was certainly true), how about a `bug' to only omit marking up the body? A customer for _SpamAssassin for Dummies_, davep -- Know what I hate most? Rhetorical questions. -- Henry N. Camp
I think you might want some of these in your /etc/mail/spamassassin/local.cf: rewrite_subject 0 report_header 1 defang_mime 0 See man Mail::SpamAssassin::Conf for more details.
Subject: Re: base64 encoded spam gets past filter thanks! davep
Not really a bug in the end, so closing it out.