[______TOC_______] [NEXT CHAPTER]

    	FML Security Advisory 2000-003: Love Letter Worm
    	========================================

    Topic:	Love Letter Worm

    			Ken'ichi Fukamachi <fukachan@sapporo.iij.ad.jp>

    	Copyright (C) 2000 Ken'ichi Fukamachi
    		All rights reserved.

    [Abstract]
       * add the rule to config.ph

       &DEFINE_FIELD_PAT_TO_REJECT("Subject", "ILOVEYOU");

       $DISTRIBUTE_FILTER_HOOK = q#
          if ($e{'Body'} =~ /Content.*\.vbs|filename=.*\.vbs/i) {
               return 'VB script attatchment';
          }
       #;

       &ADD_CONTENT_HANDLER('multipart/.*', '.*/.*', 'reject');

    [References]
      "CERT Advisory CA-2000-04 Love Letter Worm"
    http://www.cert.org/advisories/CA-2000-04.html

    http://www.f-secure.com/v-descs/love.htm
    http://www.sophos.com/virusinfo/analyses/vbsloveleta.html
    http://www.sophos.com/virusinfo/analyses/trojloveleta.html
    http://www.thepope.org/index.pl?node_id=140
    http://www.datafellows.com/v-descs/love.htm
    http://www.symantec.com/avcenter/venc/data/vbs.loveletter.a.html

-------------------------

- 1 Love Letter Worn
- 1.1 original Love Letter
- 1.2 Variant 1
- 1.3 Variant 2

- ### I Filtering

- 2 Filtering Function
- 2.1 FML Filtering
- 2.2 use "makefml config"
- 2.3 write cf
- 2.4 write config.ph
- 2.5 make secure

- 3 Add a new filtering rule
- 3.1 cf
- 3.2 config.ph
- 3.3 reject every MIME Multipart mails

- 4 other solutions
- 4.1 vf.exe
- Appendix A.1 Bugtraq
- Appendix A.2 postfix filtering
- Appendix A.3 sendmail
- Appendix A.4 uuencoded ? ------------------------- See INSTALL manual for more details on how to configure fml. http://www.fml.org/fml/INSTALL/ "CERT Advisory CA-2000-04 Love Letter Worm" [______TOC_______] [NEXT CHAPTER]

      Copyright (C) 1993-2000 Ken'ichi Fukamachi
      All rights of this page is reserved.

      # This Document(html format) is automatically geneareted by fwix.pl.
      # fwix (Formatter of WIX Language) is fml document formatter system
      # designed to generate plaintext, html, texinfo and nroff from one file.