Contributed by Dengue on from the lowest-common-denominator dept.
[Updated mc file available]
[Updated yet again to handle the .F, .G, & .I variants]
Let's face it, if you click on anything attached to an email reading:
"kindly check the attached LOVELETTER coming from me." [ Part 2, Application/OCTET-STREAM (Name: ] [ "LOVE-LETTER-FOR-YOU.TXT.vbs") 10KB. ] [ Cannot display this part. Press "V" then "S" to save in a file. ]You are naive and stupid.
Hey, brother, I have a BRIDGE I'd like to sell you.I won't even go there about the Outlook mail client.
But I recognize that some of us are responsible for some of them, so courtesty of BUGTRAQ and SENDMAIL I present for you a modified openbsd-proto.mc that you can use to regenerate your /etc/sendmail.cf or /etc/mail/sendmail.cf . to do that:
m4 openbsd-proto-iloveyou.mc > sendmail-new.cf cp /etc/sendmail.cf /etc/sendmail.bak cp sendmail-new.cf /etc/sendmail.cf kill -HUP `head -1 /var/run/sendmail.pid`I recommend checking the maillog to make sure sendmail restarted correctly, and then testing the ruleset. You should see something like this:
May 5 04:52:25 eris sendmail: restarting /usr/sbin/sendmail on signal May 5 04:52:25 eris sendmail: starting daemon (8.9.3): SMTP+queueing@00:30:00 May 5 04:52:39 eris sendmail: EAA24874: ruleset=Check_Subject, arg1=ILOVEYOU, relay=dengue@localhost, reject=553 This message may contain the LoveLetter virus. May 5 04:52:39 eris sendmail: EAA24874: from=Now keep in mind, this is a BRAINDEAD® solution to this, since all you have to do to defeat it is change the subject line. A better fix would be attachment content scanning. I encourage everyone to submit better rulesets, and I will post them here.
, size=365, class=0, pri=30365, nrcpts=1, msgid= ,proto=ESMTP, relay=dengue@localhost
This solution was built and tested on Sendmail 8.9.3 on OpenBSD 2.6. YMMV
(Comments are closed)