Distributing copies of SoBig.F

Distributing copies of SoBig.F

[Paul Fisher]

sources.redhat.com was added to our automagic sobig firewall list
today.  Please take a look at the message headers/log entry at the end
of this email.  sources.redhat.com appears to be accepting and
relaying back out SoBig.F messages.

(I've manually removed sources.redhat.com from our firewall list.)

Thanks,

Paul Fisher
Free Software Foundation


2003-08-26 17:14:18 19rl8r-0000gZ-L1 H=(sources.redhat.com) [67.72.78.213] F=<cygwin-return-79668-janneke=gnu.org@cygwin.com> rejected after DATA
Envelope-from: <cygwin-return-79668-janneke=gnu.org@cygwin.com>
Envelope-to: <janneke@gnu.org>
P Received: from [67.72.78.213] (helo=sources.redhat.com)
        by monty-python.gnu.org with smtp (Exim 4.22)
        id 19rl8r-0000gZ-L1
        for janneke@gnu.org; Tue, 26 Aug 2003 17:14:17 -0400
P Received: (qmail 32734 invoked by alias); 26 Aug 2003 02:46:32 -0000
  Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
  Precedence: bulk
  List-Unsubscribe: <mailto:cygwin-unsubscribe-janneke=gnu.org@cygwin.com>
  List-Subscribe: <mailto:cygwin-subscribe@cygwin.com>
  List-Archive: <http://sources.redhat.com/ml/cygwin/>
  List-Post: <mailto:cygwin@cygwin.com>
  List-Help: <mailto:cygwin-help@cygwin.com>, <http://sources.redhat.com/ml/#faqs>
S Sender: cygwin-owner@cygwin.com
  Mail-Followup-To: cygwin@cygwin.com
  Delivered-To: mailing list cygwin@cygwin.com
P Received: (qmail 31026 invoked from network); 26 Aug 2003 02:40:34 -0000
P Received: from unknown (HELO SONY) (67.116.240.247)
  by sources.redhat.com with SMTP; 26 Aug 2003 02:40:34 -0000
F From: <niner@wired.com>
T To: <cygwin@cygwin.com>
  Subject: Re: That movie
  Date: Mon, 25 Aug 2003 19:40:34 --0700
  X-MailScanner: Found to be clean
  Importance: Normal
  X-MSMail-Priority: Normal
  X-Priority: 3 (Normal)
  MIME-Version: 1.0
  Content-Type: multipart/mixed;
        boundary="_NextPart_000_01323750"
I Message-Id: <E19rl8r-0000gZ-L1@monty-python.gnu.org>

Re: Distributing copies of SoBig.F

[Christopher Faylor]

On Tue, Aug 26, 2003 at 06:24:19PM -0400, Paul Fisher wrote:
>sources.redhat.com was added to our automagic sobig firewall list
>today.  Please take a look at the message headers/log entry at the end
>of this email.  sources.redhat.com appears to be accepting and
>relaying back out SoBig.F messages.

This particular message was the virus message without the payload so it
wasn't much of a threat.  It happened during a brief outage in the spam
blocking last night.  I was working on stopping more of the virus
messages from being bounced but I screwed up one of the regexes in the
filter.