Mailing List Archive

found a bug.
i think i just found a "bug" or a new trick used bu the virus:

------------AW588S41FJ8DUE
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit


------------AW588S41FJ8DUE
Content-Type: application/x-msdownload; name="FamPerez.jpg.scr"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="FamPerez.jpg.scr"

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v
ZGUuDQ0KJAAAAAAAAABxdTv8NRRVrzUUVa81FFWvTghZrzEUVa+2CFuvNxRVr90LX68gFFWv3QtR
rzcUVa9XC0avPhRVrzUUVK+OFFWv3QterzoUVa+NElOvNBRVr1JpY2g1FFWvAAAAAAAAAABQRQAA
TAEDAF1Flz0AAAAAAAAAAOAADwELAQYAAMAAAAAQAAAAQAYAQA0HAABQBgAAEAcAAABAAAAQAAAA
AgAABAAAAAAAAAAEAAAAAAAAAAAgBwAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAA
AAAAAAAAAAAAAGQQBwBkAQAAABAHAGQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
...............

The file is not extracted and so the virus is not discovered (it's a
bugbear send).
Re: Re: found a bug. [ In reply to ]
On Wed, 6 Nov 2002 13:18:56 +0100 (MET)
Emmanuel Collignon <manu@univ-lr.fr> wrote:

>
> found it !!!
>
> i have to change the strlower code (strlower.c):
>
> int strlower( unsigned char *convertme ){
> unsigned char *c = convertme;
>

Thanks, what files/line was that in? for what version of ripMIME ?

btw, welcome to the ripMIME mailing list ;-)

--
Paul L Daniels http://www.pldaniels.com
Linux/Unix systems Internet Development
ICQ#103642862,AOL:cinflex,IRC:inflex
A.B.N. 19 500 721 806
Re: found a bug. [ In reply to ]
found it !!!

i have to change the strlower code (strlower.c):

int strlower( unsigned char *convertme ){
unsigned char *c = convertme;


I must use (unsigned char * ) instead of (char *) because of the non ascii
char in french.


And now, it's ok (tested on HPUX 11.11 with HP ansi C)