Bug 872 - false negative caused by bad MIME parsing
Summary: false negative caused by bad MIME parsing
Status: RESOLVED FIXED
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: Libraries (show other bugs)
Version: 2.41
Hardware: Other NetBSD
: P2 normal
Target Milestone: ---
Assignee: SpamAssassin Developer Mailing List
URL:
Whiteboard:
Keywords: mime
: 1259 (view as bug list)
Depends on: 130
Blocks:
  Show dependency tree
 
Reported: 2002-09-10 18:53 UTC by Klaus Heinz
Modified: 2002-12-20 01:32 UTC (History)
1 user (show)



Attachment Type Modified Status Actions Submitter/CLA Status
spam mail triggering the bug application/octet-stream None Klaus Heinz [HasCLA]

Note You need to log in before you can comment on or make changes to this bug.
Description Klaus Heinz 2002-09-10 18:53:55 UTC
Hi,

"Stewart, John" <johns@artesyncp.com> has discovered the following problem
with SA (see <F9102D41F595D311ACA7009027DE2C8404E11FA3@c3po.heurikon.com> on
SA-talk):
-------------------------------------------------------------------------
Penis enlargement phrases, money back guarantee, shouldn't this score
higher?
  
SPAM: -------------------- Start SpamAssassin results ----------------------
SPAM: This mail is probably spam.  The original message has been altered
SPAM: so you can recognise or block similar unwanted mail in future.
SPAM: See http://spamassassin.org/tag/ for more details.
SPAM:  
SPAM: Content analysis details:   (2.40 hits, 5 required) 
SPAM: NO_REAL_NAME       (-0.3 points) From: does not include a real name 
SPAM: SPAM_PHRASE_00_01  (0.6 points)  BODY: Spam phrases score is 00 to 01
(low)  
SPAM: FROM_AND_TO_SAME_1 (2.1 points)  From and To the same (1)
SPAM:
SPAM: -------------------- End of SpamAssassin results ---------------------

Using SA 2.41 with amavisd-new. I've not got the old version(s) installed,
so I didn't try it with them, but this sure seems like a spammy email to me.

johnS
-------------------------------------------------------------------------

I have investigated a bit and it seems the bug is due to bad MIME parsing
in SA.

Changing the 'Content-Type' from 'multipart/mixed' to 'text/plain' did not
work around the bug. But removing the 'Boundary' attribute did the trick.
With this change, I got
  
        tests=EXCUSE_16,FROM_AND_TO_SAME_1,IMPOTENCE,MONEY_BACK,
              NO_REAL_NAME,PENIS_ENLARGE,PENIS_ENLARGE2,REMOVE_PAGE,
              SPAM_PHRASE_00_01

I have attached the spam mail provided by John Stewart.

Unfortunately I cannot use Johns address in the Cc: field. Bugzilla complains
that 'johns@artesyncp.com' is not a valid user name.

ciao
     Klaus
Comment 1 Klaus Heinz 2002-09-10 18:54:55 UTC
Created attachment 322 [details]
spam mail triggering the bug
Comment 2 Duncan Findlay 2002-09-20 21:21:42 UTC
MIME related
Comment 3 Duncan Findlay 2002-12-12 20:32:35 UTC
*** Bug 1259 has been marked as a duplicate of this bug. ***
Comment 4 Justin Mason 2002-12-20 10:32:38 UTC
fixed