Bug 723 - base64 encoded spam gets past filter
Summary: base64 encoded spam gets past filter
Status: RESOLVED INVALID
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: spamassassin (show other bugs)
Version: 2.31
Hardware: Other FreeBSD
: P2 normal
Target Milestone: ---
Assignee: SpamAssassin Developer Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2002-08-20 08:41 UTC by David Panariti
Modified: 2002-08-22 19:11 UTC (History)
0 users



Attachment Type Modified Status Actions Submitter/CLA Status
actual copy of spam text/plain None David Panariti [NoCLA]

Note You need to log in before you can comment on or make changes to this bug.
Description David Panariti 2002-08-20 08:41:22 UTC
I've had two spams so far that encode the text of the message as base64.  They 
do not get identified as spam by my installation of spamassassin.
If I use metamail to decode the spam and feed that to spamassassin then it is 
identified properly as spam.
Here's a complete example(there really is garbage in the Date: header):

Delivered-To: davep@baloo.meduseld.net
Received: from mail.attbi.com (204.127.202.7) by baloo.meduseld.net with POP3
  for <davep@meduseld.net>; 20 Aug 2002 04:15:01 -0000
Return-Path: <liyf_pfqj_b_a_c@meduseld.net>
Received: from mail3.godaddy.com ([63.241.136.243]) by sccrgwc04.attbi.com
          (InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP
          id <20020820040223.XWLX7866.sccrgwc04.attbi.com@mail3.godaddy.com>
          for <panariti@attbi.com>; Tue, 20 Aug 2002 04:02:23 +0000
Received: (qmail 14043 invoked by uid 508); 20 Aug 2002 04:01:25 -0000
Delivered-To: meduseld-net-davep@meduseld.net
Received: (qmail 14041 invoked from network); 20 Aug 2002 04:01:25 -0000
Received: from unknown (HELO mailstore1.secureserver.net) (63.241.136.82)
  by mail3.secureserver.net with SMTP; 20 Aug 2002 04:01:25 -0000
Received: (qmail 21210 invoked from network); 20 Aug 2002 04:02:19 -0000
Received: from unknown (HELO bobos-server) (211.233.14.41)
  by mailstore1.secureserver.net with SMTP; 20 Aug 2002 04:02:19 -0000
From: "" <Peter>
To: "davep" <davep@meduseld.net>
Subject: Very Important!
Date: Tue, 20 Aug 02 11:54:37 ´ëÇѹα¹ Ç¥ÁؽÃ
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary= "----
=_NextPart_000_0099_C921044.5C31E1BB"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2462.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2462.0000 
Message-Id: <20020820040223.XWLX7866.sccrgwc04.attbi.com@mail3.godaddy.com>

------=_NextPart_000_0099_C921044.5C31E1BB
Content-Type: text/html
Content-Transfer-Encoding: base64

LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS08YnI+VGhpcyBtZXNzYWdl
IHdhcyBzZW50IGJ5IEV4cHJlc3MgRGlyZWN0IEVtYWlsIEJsYXN0ZXIgVjUuMSwgPGJyPnlv
dSBjYW4gZG93bmxvYWQgaXQgZnJvbTogPGEgaHJlZj0iaHR0cDovL3d3dy5mYXN0YnVsa2Vt
YWlsLmNvbSI+d3d3LmZhc3RidWxrZW1haWwuY29tPC9hPjxicj5FeHByZXNzIERpcmVjdCBF
bWFpbCBCbGFzdGVyIGlzIGEgcG93ZXJmdWwgZW1haWwgbWFya2V0aW5nIHRvb2whITxicj4t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPGJyPjxicj5IaSBwYWxzLg0K
DQpJIGhhdmUgcmVjZW50bHkgZm91bmQgYSBwcm9ncmFtIHRoYXQgcGF5cyB5b3UganVzdCBm
b3Igc3VyZmluZyB0aGUgbmV0LiBZb3UgY2FuIGVhcm4gdXAgdG8gVVMkMC43MCBhbiBob3Vy
LiBUaGlzIGlzIHRydWUhDQoNCkkgaGF2ZSBlYXJuZWQgbW9yZSB0aGFuIFVTJDIwMCsgYSBt
b250aCBqdXN0IGJ5IHN1cmZpbmcgdGhlIG5ldC4gWW91IGNhbiBkbyB0aGUgc2FtZSB0b28u
DQpJbnRlcm5hdGlvbmFsIHN1cmZlcnMgYXJlIHdlbGNvbWVkIHRvbyAhDQpEb24ndCBoZXNp
dGF0ZSAuIEpvaW4gbm93ICENCg0KaHR0cDovL3d3dy5zcGVkaWEubmV0L2NnaS1iaW4vdHou
Y2dpP3J1bj1zaG93X3N2YyZmbD04JnZpZD0zNDMxMzU5DQoNClJlZ2FyZHMsDQpwZXRlciAg
ICA=
------=_NextPart_000_0099_C921044.5C31E1BB--
Comment 1 Malte S. Stretz 2002-08-20 09:11:20 UTC
The Content-Type header looks interesting but I think there just sneaked a 
newline in when you copied & pasted. Can you please save that message to a 
file and _attach_ it to this bug report? (Click on "Create a new attachment" 
to do so.) 
Comment 2 David Panariti 2002-08-20 09:54:36 UTC
Created attachment 279 [details]
actual copy of spam
Comment 3 David Panariti 2002-08-20 10:00:07 UTC
Subject: Re:  base64 encoded spam gets past filter

>>>>> "anon" == bugzilla-daemon  <bugzilla-daemon@hughes-family.org> writes:

   http> //www.hughes-family.org/bugzilla/show_bug.cgi?id=723
   anon> ------- Additional Comments From
   anon>         spamassassin-contrib@msquadrat.de 2002-08-20 09:11
   anon>         -------
   anon> The Content-Type header looks interesting but I think there
   anon> just sneaked a newline in when you copied & pasted. Can you
   anon> please save that message to a file and _attach_ it to this
   anon> bug report? (Click on "Create a new attachment" to do so.)
Done.
There is no attach field on the submit a bug page.
It seems like adding one would prevent a lot of unnecessary email
traffic (like this one :-)

davep

--
An idea is not responsible for the people who believe in it.

Comment 4 Malte S. Stretz 2002-08-20 11:25:46 UTC
I can't reproduce that behavior. Hmmm... which SA version do you use? There's 
no X-Spam-Status header in the mail. Is it possible that it never got 
processed? Here are the scores from the current versions: 
 
X-Spam-Status: Yes, hits=16.4 required=5.0 
	tests=FROM_MALFORMED,TO_LOCALPART_EQ_REAL,INVALID_DATE,PLING, 
	      DIRECT_EMAIL,EMAIL_MARKETING,RAZOR_CHECK,BASE64_ENC_TEXT, 
	      DATE_IN_FUTURE_06_12,RCVD_IN_RFCI 
	version=2.31-mss2 
X-Spam-Status: Yes, hits=15.0 required=5.0 
	tests=BASE64_ENC_TEXT,DATE_IN_FUTURE_06_12,DIRECT_EMAIL, 
	      EMAIL_MARKETING,EXPECT_TO_EARN,HEADER_8BITS,INVALID_DATE, 
	      MIME_HTML_NO_CHARSET,RAZOR_CHECK,RCVD_IN_RFCI, 
	      SPAM_PHRASE_02_03,USER_AGENT_OE 
	version=2.40-cvs 
 
Comment 5 David Panariti 2002-08-20 11:47:07 UTC
Subject: Re:  base64 encoded spam gets past filter

SpamAssassin version 2.31

When I run thus:
spamassassin -S -P -L -F0 -d <~/tmp/spam0
which is how my .procmailrc does, it *IS NOT* spam

When I run like this:
spamassassin -P -L  <~/tmp/spam0
It *IS* spam

My current set of options seems to work for other cases, and I think
they are a legal combination.

I just checked, it looks like the -F0 is causing it.
I need that since the From line makes supercite complain about a
non-compliant header line.

Perhaps in addition to this bug, spamassassin and supercite should be
made to play together?

davep

--
"I don't trust software that I have to pay for."
		-- davep

Comment 6 Malte S. Stretz 2002-08-20 12:03:02 UTC
Maybe you should try it without the -d? :) 
| -d, --remove-markup                Remove spam reports from a message 
 
Comment 7 David Panariti 2002-08-20 12:38:50 UTC
Subject: Re:  base64 encoded spam gets past filter

I made too many changes at once.  But I could've sworn I've seen spam
notices since I made them all.  Perusal of +trash belies that.

But the man page is misleading, IMO.
To me it implied that it would only omit adding markup headers.
I guess the note:

	   (Note: the message will not be exactly identical; some
	   headers will be reformatted due to some features of
	   the Mail::Internet package, but the body text will
	   be.)

which was *EXACTLY* what I was looking for: body text unaltered but
headers reformatted, threw me.
No extra pages of why this thing was spam.  I'm still getting used to
spamassassin and still look at what it considers spam, especially
since it has been way off in a few cases.

My humblest apologies.

But since `bug' can be interpreted as `feature' (as in that's not a
bug that's a feature, which in this case was certainly true), 
how about a `bug' to only omit marking up the body?

A customer for _SpamAssassin for Dummies_,

davep

--
Know what I hate most?  Rhetorical questions.
		-- Henry N. Camp

Comment 8 Malte S. Stretz 2002-08-20 13:42:25 UTC
I think you might want some of these in your /etc/mail/spamassassin/local.cf: 
rewrite_subject 0 
report_header 1 
defang_mime 0 
 
See man Mail::SpamAssassin::Conf for more details. 
Comment 9 David Panariti 2002-08-20 13:46:14 UTC
Subject: Re:  base64 encoded spam gets past filter

thanks!

davep

Comment 10 Craig Hughes 2002-08-23 03:11:37 UTC
Not really a bug in the end, so closing it out.