Security Incidents mailing list archives

Re: Possible Mail server compromise ?


From: Valdis.Kletnieks () vt edu
Date: Tue, 19 Feb 2008 20:51:27 -0500

On Tue, 19 Feb 2008 19:46:35 +0100, "Faas M. Mathiasen" said:

Anyways in this case I am not sure about it, have you read the
"Security through No-Parsing" paradigma ? They apparently don't parse
the data and put everything in a sealed environment.

Well, *duh* - if you don't bother virus-scanning, and just dump everything
in a quarantine area, of course your virus-scanner won't get compromised. :)

Of course, that *does* leave you with the sticky question - how do you know
if/when it's safe to look at/examine/open a file that's been dumped in the
quarantine area? :)

Attachment: _bin
Description:


Current thread: