Meaning of ".asc" in BANNED messages
Tom Hendrikx
tom at whyscream.net
Tue Mar 8 18:31:23 CET 2016
Hi,
A pgp signature, this message has one
Regards,
Tom
On 08-03-16 16:58, @lbutlr wrote:
> I have a quick question, the BANNED emails so far all seem to report the following:
>
>> No viruses were found.
>>
>> Banned name: .asc,letter.212885777.js
>> Content type: Banned
>
>
> The banned name always matches .asc,<something>.js (usually letter or invoice and a number).
>
> What is “.asc” since that is not a banned attachment.
>
> $banned_filename_re = new_RE(
>
> ### BLOCKED ANYWHERE
> qr'^\.(exe-ms|dll)$', # banned file(1) types, rudimentary
>
> ### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES:
> [ qr'^\.(gz|bz2)$' => 0 ], # allow any in gzip or bzip2
> [ qr'^\.(rpm|cpio|tar)$' => 0 ], # allow any in Unix-type archives
>
> ### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES:
> [ qr'^\.(gz|bz2)$' => 0 ], # allow any in gzip or bzip2
> [ qr'^\.(rpm|cpio|tar)$' => 0 ], # allow any in Unix-type archives
>
> ### BLOCK THE FOLLOWING, EXCEPT WITHIN ARCHIVES:
> [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ], # allow any within these archives
>
> qr'^application/x-msdownload$'i, # block these MIME types
> qr'^application/x-msdos-program$'i,
> qr'^application/hta$'i,
>
> qr'^(?!cid:).*\.[^./]*[A-Za-z][^./]*\.\s*(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)[.\s]*$'i,
> qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|inf|ini|ins|isp|js|jse|lib|lnk|mda|mdb|mde|mdt|mdw|mdz|msc|msi|msp|mst|ocx|ops|pcd|pif|prg|reg|scr|sct|shb|shs|sys|vb|vbe|vbs|vxd|wmf|wsc|wsf|wsh)$'ix, # banned extensions - long
> qr'.\.(ani|cur|ico)$'i, # banned cursors and icons filename
> qr'^\.ani$', # banned animated cursor file(1) type
> qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i, # banned extension - WinZip vulnerab.
> );
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://lists.amavis.org/pipermail/amavis-users/attachments/20160308/ec89f0c8/attachment.sig>
More information about the amavis-users
mailing list