[______TOC_______] [NEXT CHAPTER]

    	FML Security Advisory 2000-003: Love Letter Worm
    	========================================

    Topic:	Love Letter Worm

    			Ken'ichi Fukamachi <fukachan@sapporo.iij.ad.jp>

    	Copyright (C) 2000 Ken'ichi Fukamachi
    		All rights reserved.

    [Abstract]
       * add the rule to config.ph

       &DEFINE_FIELD_PAT_TO_REJECT("Subject", "ILOVEYOU");

       $DISTRIBUTE_FILTER_HOOK = q#
          if ($e{'Body'} =~ /Content.*\.vbs|filename=.*\.vbs/i) {
               return 'VB script attatchment';
          }
       #;

       # MIME Multipart のメールをすべて拒否する
       &ADD_CONTENT_HANDLER('multipart/.*', '.*/.*', 'reject');

    [References]
      "CERT Advisory CA-2000-04 Love Letter Worm"
    http://www.cert.org/advisories/CA-2000-04.html

    http://www.f-secure.com/v-descs/love.htm
    http://www.sophos.com/virusinfo/analyses/vbsloveleta.html
    http://www.sophos.com/virusinfo/analyses/trojloveleta.html
    http://www.thepope.org/index.pl?node_id=140
    http://www.datafellows.com/v-descs/love.htm
    http://www.symantec.com/avcenter/venc/data/vbs.loveletter.a.html

-------------------------

- 1 Love Letter Worn
- 1.1 original Love Letter
- 1.2 Variant 1
- 1.3 Variant 2

- ### I フィルタリング

- 2 フィルタリング機能
- 2.1 fml フィルタリング機能について
- 2.2 makefml config を使う人
- 2.3 cf 書きの人
- 2.4 config.ph 生書きの人
- 2.5 make secure

- 3 フィルタリングに新ルールを加える
- 3.1 cfを使う人
- 3.2 config.phを使う人
- 3.3 MIME Multipart のメールをすべて拒否する

- 4 other solutions
- 4.1 vf.exe

- Appendix A Information
- Appendix A.1 Bugtraq
- Appendix A.2 postfix filtering
- Appendix A.3 sendmail
- Appendix A.4 uuencoded ? ------------------------- 手順の意味についてはINSTALLマニュアルを参照して下さい http://www.fml.org/fml/INSTALL/ "CERT Advisory CA-2000-04 Love Letter Worm" [______TOC_______] [NEXT CHAPTER]

      Copyright (C) 1993-2000 Ken'ichi Fukamachi
      All rights of this page is reserved.

      # This Document(html format) is automatically geneareted by fwix.pl.
      # fwix (Formatter of WIX Language) is fml document formatter system
      # designed to generate plaintext, html, texinfo and nroff from one file.