Meaning of ".asc" in BANNED messages
@lbutlr
kremels at kreme.com
Tue Mar 8 16:58:31 CET 2016
I have a quick question, the BANNED emails so far all seem to report the following:
> No viruses were found.
>
> Banned name: .asc,letter.212885777.js
> Content type: Banned
The banned name always matches .asc,<something>.js (usually letter or invoice and a number).
What is “.asc” since that is not a banned attachment.
$banned_filename_re = new_RE(
### BLOCKED ANYWHERE
qr'^\.(exe-ms|dll)$', # banned file(1) types, rudimentary
### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES:
[ qr'^\.(gz|bz2)$' => 0 ], # allow any in gzip or bzip2
[ qr'^\.(rpm|cpio|tar)$' => 0 ], # allow any in Unix-type archives
### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES:
[ qr'^\.(gz|bz2)$' => 0 ], # allow any in gzip or bzip2
[ qr'^\.(rpm|cpio|tar)$' => 0 ], # allow any in Unix-type archives
### BLOCK THE FOLLOWING, EXCEPT WITHIN ARCHIVES:
[ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ], # allow any within these archives
qr'^application/x-msdownload$'i, # block these MIME types
qr'^application/x-msdos-program$'i,
qr'^application/hta$'i,
qr'^(?!cid:).*\.[^./]*[A-Za-z][^./]*\.\s*(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)[.\s]*$'i,
qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|inf|ini|ins|isp|js|jse|lib|lnk|mda|mdb|mde|mdt|mdw|mdz|msc|msi|msp|mst|ocx|ops|pcd|pif|prg|reg|scr|sct|shb|shs|sys|vb|vbe|vbs|vxd|wmf|wsc|wsf|wsh)$'ix, # banned extensions - long
qr'.\.(ani|cur|ico)$'i, # banned cursors and icons filename
qr'^\.ani$', # banned animated cursor file(1) type
qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i, # banned extension - WinZip vulnerab.
);
--
'Dojo! What is Rule One?' Even the cowering challenger mumbled along to
the chorus: 'Do not act incautiously when confronting little bald
wrinkly smiling men!'
More information about the amavis-users
mailing list