[prev in list] [next in list] [prev in thread] [next in thread] 

List:       amavis-user
Subject:    RE: Using Amavis to reject/quarantine email with MIME-encoded Subject Fields
From:       Benedict White <Benedict.White () cse-ltd ! co ! uk>
Date:       2021-08-31 22:57:00
Message-ID: ACF27D5D1618A443A0D3B7F1A28B4CDA0825FEBFB0AA () snowball
[Download RAW message or body]

-----Original Message-----
From: amavis-users [mailto:amavis-users-bounces+benedict.white=cse-ltd.co.uk@amavis.org] \
                On Behalf Of Benny Pedersen
Sent: 31 August 2021 20:44
To: amavis-users@amavis.org
Subject: Re: Using Amavis to reject/quarantine email with MIME-encoded Subject Fields

On 2021-08-31 18:58, Benedict White wrote:

> header  MyRuleNumberOne          Subject =~ /RgNC10LTQ/i
> 
> score	MyRuleNumberOne		5.0
> 
> The rules looks for something containing " RgNC10LTQ" and the i after
> the / means case insensitive. You can remove that if this is the
> precise spelling you are looking for.

https://spamassassin.apache.org/full/3.1.x/doc/Mail_SpamAssassin_Plugin_WhiteListSubject.html


it supports blacklist :=)

it must be mime decoded content in the blacklist_subject ....


###
My understanding is that the subject appears in the header and isn't encoded. The \
reason it appears as this gobbledegook is an error in the spam generation, as such, \
the error can be exploited with a simple rule as I wrote.

Kind regards

Benedict White


[prev in list] [next in list] [prev in thread] [next in thread]