	FML Security Advisory 1999-004: melissa family macro virus
	========================================

Update 1999-003

			Ken'ichi Fukamachi <fukachan@sapporo.iij.ad.jp>

	Copyright (C) 1999,2001 Ken'ichi Fukamachi
		All rights reserved.

[Abstract]

What is melissa virus? See

	http://www.cert.org/advisories/CA-99-04-Melissa-Macro-Virus.html

You can reject Melissa original by Subject: keyword. See

	http://www.fml.org/fml/advisories/FA1999_003/index.html

However you cannot reject Melissa variation. Here we describe how do
we reject Melissa and the descendents and fml configurations.

-------------------------
------------------------------------------------------------
1	How to reject special word file
1.1	Theory of rejection
1.2	Condition of rejection
1.3	What virus can we reject

2	Configuration after fml 2.2A#42
2.1	Introduction

3	Configuration before fml 2.2A#42
3.1	Files to get
3.2	cf case
3.3	config.ph
3.4	Hook to paste

Appendix A	Filtering Function
Appendix A.1	FML Filtering
Appendix A.2	use "makefml config"
Appendix A.3	write cf 
Appendix A.4	write config.ph
Appendix A.5	make secure
------------------------------------------------------------

-------------------------

	http://www.fml.org/fml/INSTALL/

1	How to reject special word file

1.1	Theory of rejection

Condition 1.

	http://www.zdnet.co.jp/news/9903/30/melissa3.html

tells us that Melissa virus has GUID which is personal information
key. But the ordinary word file has no such GUID. GUID may be appended
if the file contains macros.

Condition 2.

We know GUID regexp.

1.2	Condition of rejection

The word file does not have GUID under usual environment.
Fml tries to reject the mail of MIME/Multipart with GUID.

1.3	What virus can we reject

Melissa original and Melissa descenders.
Example:  Melissa, PDS2000

2	Configuration after fml 2.2A#42

2.1	Introduction

fml-current, fml 2.2.1 release and current after fml 2.2A#42 has virus
check function within fml filter. If you eanble fml filtering (FML
Envelope Filter), you can use this virus check also.

If you do not want virus check, unset $FILTER_ATTR_REJECT_MS_GUID.
ref: Filtering => Appendix A

3	Configuration before fml 2.2A#42

Please give up if you use fml before fml 1.6.

3.1	Files to get

	ftp://ftp.fml.org/pub/fml/current/src/src/libviruschk.pl

3.2	cf case

Cut and paste the hook below after 'LOCAL_CONFIG' line in cf and run

	% make config.ph

3.3	config.ph

Cut and paste the hook below in config.ph (before 1;).

3.4	Hook to paste

---------->8---------->8---------->8---------->8---------->8----------
$START_HOOK = q!;

local(%e) = %Envelope;
local($boundary);

# MIME skip mode; against automatic-MIME-encapsulated fool MUA
if ($e{'h:content-type:'} =~ /boundary=\"(.*)\"/i ||
    $e{'h:content-type:'} =~ /boundary=\s*(\S+)/i) {
    $boundary = $1;
    $boundary = "--$boundary";
    $e{'MIME:boundary'} = $boundary;

    require 'libviruschk.pl';
    $r = &VirusCheck(*e);

    if ($r) { 
	$DO_NOTHING = 1;
	&Log("EnvelopeFilter::reject for '$r'");
	&Warn("Rejected mail by FML EnvelopeFilter $ML_FN", 
	      "Mail from $From_address\nis rejected for '$r'.\n".&WholeMail);
    }
}

!;
---------->8---------->8---------->8---------->8---------->8----------

Appendix A	Filtering Function

Appendix A.1	FML Filtering

Fml has filtering mechanism based on mail header and body after fml
2.2 (2.2 officially but fml 2.1 current unofficially). You can
deny/reject mail with some patterns. If you can find
$USE_DISTRIBUTE_FILTER in fml source, the version has filtering
function.

In default fml filtering is off. Firstly you should turn on it. 
Consider elena ML hereafter as an example.

To enable filtering function, you can do one of the following methods
which are the same. Please use one you are familliar with.

Appendix A.2	use "makefml config"

   "makefml config elena" -> security -> USE_DISTRIBUTE_FILTER -> "y" (yes)

Appendix A.3	write cf 

Write

   USE_DISTRIBUTE_FILTER 1

and run to remake config.ph

	% make config.ph

Appendix A.4	write config.ph

   $USE_DISTRIBUTE_FILTER = 1;

Appendix A.5	make secure

To enable all typical security options, run

   % cd /var/spool/ml/elena
   % make secure

