[35436] in bugtraq
Re: Virus scan attack
daemon@ATHENA.MIT.EDU (Vincent Archer)
Tue Jun 22 19:24:16 2004
Date: Tue, 22 Jun 2004 09:34:05 +0200
From: Vincent Archer <var@deny-all.com>
To: "Joao B. Diehl" <diehl@dpi.inpe.br>
Cc: Nate Nord <natenord@maximus.com>, visitbipin@hotmail.com,
bugtraq@securityfocus.com
Message-ID: <20040622073405.GA14712@DAPCVA.da>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <40D44D15.1080306@dpi.inpe.br>
On Sat, Jun 19, 2004 at 11:26:29AM -0300, Joao B. Diehl wrote:
> We had this same problem with the DAT 4367. Returning to
> DAT 4366 it worked again.
>
> Nate Nord wrote:
> >Just wondering if anyone else has seen this come through their mail portal.
> >Something has caused our McAfee Webshield SMTP to seriously eat processor
> >time... to the point that it will no longer forward scanned mail. I've had
> >to temporarily bypass it until I figure out what it's choking on. I saw
> >several other posts that said this sent processors into some kind of loop
> >and this is exactly what appears to be happening with our portal.
Witnessed on a linux and solaris installs. In both cases, reverting to the
previous dat archive restored function.
--
Vincent ARCHER
Spécialiste système & sécurité
varcher@deny-all.com <mailto:varcher@deny-all.com>
Tel : +33 (0)1 40 07 47 14
Fax : +33 (0)1 40 07 47 27
Deny All - 5, rue Scribe - 75009 Paris - France
www.deny-all.com
