Re: ALERT: Emacs GNUS can spread a virus invisibly

[Chris Brightman <chris@jazzyb.org.uk>]

>>>>> "Chris" == Chris  <chris@jazzyb.org.uk> writes:

>>>>> "GLM" == Gary Lawrence Murphy <garym@canada.com> writes:
    GLM> I don't know why the second part was hidden in the GNUS display, and
    GLM> if there is a setting to show this message for what it actually
    GLM> contained, I don't know what it is, but it needs to get fixed.

    Chris> There are two complete sets of MIME boundaries using the same
    Chris> boundary string in messages I have seen that do this
    Chris> (unfortunately you did not paste enough to show conclusively that
    Chris> this is the same malformation, but your description is consistent
    Chris> with it).  The second set are technically MIME epilogue according
    Chris> to RFC2046.  Unfortunately some MUAs (such as OE) continue parsing
    Chris> with the same boundary string.

    Chris> The content after that final boundary is epilogue and should not
    Chris> be displayed by MUAs.  Perhaps when forwarding messages, the MIME
    Chris> prologue and epilogue should be discarded?

OK, I take back what I wrote the other day.  What I described *is* an exploit
used by some viruses to transport themselves, but having looked at the sample
posted earlier today, this is not an example of it. (incidentally, I can't
find that sample now, maybe it was cancelled?)

This is a generic MIME (Microsoft) exploit, details are available at:

http://vil.nai.com/vil/content/v_99273.htm
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.e@mm.html

Technical data on the vulnerability are at:

http://www.microsoft.com/technet/security/bulletin/MS01-020.asp


My view as a Gnus user to this is that I don't want to be responsible for
unknowingly sending executable attachments to others.  I take Kai's point
that the modeline indicates the number of parts, but is there a way to easily
modify the display of such messages within Gnus?  I would like to see more
information within the article buffer - what are my options?

Thanks

Chris