Re: 'spamc/spamassassin' crashing with overlong blank line spams?

From: Matt Kettler <mkettler_sa(at)verizon.net>
Date: Wed Sep 19 2007 - 00:54:24 EDT

Chr. v. Stuckrad wrote:
> Hi!
>
> Seemingly our spamc (3.1.9, not yet 3.2.*) can not
> transfer a special kind of current spam to a remote
> spamd. Those Mails always produce '0/0' instead
> of usable reports.
>
> You can see something like the Mail I analyzed
> at http://page.mi.fu-berlin.de/stucki/mail.txt
> (I had change the offending line for the browser too,
> so at the end you seen a descriptive line only)
>
> Is this a known failure of the old spamc?
> Is the MTA supposed to fix Mails with overlong
> blank/any lines?
>

AFAIK, that's not a known issue in any version of spamc.

If you can provide a copy of the actual email somewhere, (I can download it with wget, or you can zip/gzip/whatever it) I can run it through spamc on my test box and see what it does.

> Do I have to switch to 3.2.* to fix it?
>
> Would it be possible to 'just take' a
> newer 'spamc (3.2.*)' to communicate to
> an old 'spamd(3.1.*)' or did the protocol
> change somehow?
>
> Thanks for hints ... Yours Stucki
>
> PS.: Ideas welcome for catching the characteristic Subject of
> those spams, which look like 'just random tty line noise'!
>

Something like this might be a first shot:

header NO_ALPHA_SUBJECT Subject !~ /[a-zA-Z0-9]/ score NO_ALPHA_SUBJECT 0.1
describe NO_ALPHA_SUBJECT Subject line contains no alphanumeric characters.

But that would also hit empty subjects.. if that's undesirable you could do this:

header __SUBJ_NO_ALPHA     Subject !~ /[a-zA-Z0-9]/
header __SUBJ_NOT_EMPTY     Subject =~ /./
meta NO_ALPHA_SUBJECT2     (__SUBJ_NO_ALPHA && __SUBJ_NOT_EMPTY)

score NO_ALPHA_SUBJECT2 0.2
describe NO_ALPHA_SUBJECT2 Subject is nonempty and contains no alphanumeric characters.

Note: these rules are untested, hence the low scores. Received on Wed Sep 19 00:55:23 2007