Meaning of ".asc" in BANNED messages

@lbutlr kremels at kreme.com
Tue Mar 8 16:58:31 CET 2016


I have a quick question, the BANNED emails so far all seem to report the following:

> No viruses were found.
> 
> Banned name: .asc,letter.212885777.js
> Content type: Banned


The banned name always matches .asc,<something>.js (usually letter or invoice and a number).

What is “.asc” since that is not a banned attachment.

$banned_filename_re = new_RE(

### BLOCKED ANYWHERE
  qr'^\.(exe-ms|dll)$',                   # banned file(1) types, rudimentary

### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES:
  [ qr'^\.(gz|bz2)$'             => 0 ],  # allow any in gzip or bzip2
  [ qr'^\.(rpm|cpio|tar)$'       => 0 ],  # allow any in Unix-type archives

### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES:
  [ qr'^\.(gz|bz2)$'             => 0 ],  # allow any in gzip or bzip2
  [ qr'^\.(rpm|cpio|tar)$'       => 0 ],  # allow any in Unix-type archives

### BLOCK THE FOLLOWING, EXCEPT WITHIN ARCHIVES:
 [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ],  # allow any within these archives

  qr'^application/x-msdownload$'i,        # block these MIME types
  qr'^application/x-msdos-program$'i,
  qr'^application/hta$'i,

  qr'^(?!cid:).*\.[^./]*[A-Za-z][^./]*\.\s*(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)[.\s]*$'i,
  qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|inf|ini|ins|isp|js|jse|lib|lnk|mda|mdb|mde|mdt|mdw|mdz|msc|msi|msp|mst|ocx|ops|pcd|pif|prg|reg|scr|sct|shb|shs|sys|vb|vbe|vbs|vxd|wmf|wsc|wsf|wsh)$'ix,  # banned extensions - long 
  qr'.\.(ani|cur|ico)$'i,                 # banned cursors and icons filename
  qr'^\.ani$',                            # banned animated cursor file(1) type
  qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i,  # banned extension - WinZip vulnerab.
);
-- 
'Dojo! What is Rule One?' Even the cowering challenger mumbled along to
the chorus: 'Do not act incautiously when confronting little bald
wrinkly smiling men!'



More information about the amavis-users mailing list