[Mimedefang] Two Subject lines in header

[Sean Ware]

Chris Carey (chris.carey at gmail.com) @ 2006.06.29 09:04:06 -0600:
> I received a spam message today that the subject line was not tagged.
> Investigating the header I found why.
> 
> "Subject" was specified twice. MIMEDefang only modifed the first "Subject" 
> line.
> 
> MIMEDefang modified the *first* subject with "[spam 15 hits]", but the
> second remained unchanged. Mozilla Thunderbird chose to use the second
> unchanged subject line as the one to show. Having "Subject" twice in
> the email headers seems to be a way to get spam to arrive in someones
> inbox without client-side rules catching it..
> 
> So the obvious question - How to have MIMEDefang catch when Subject is
> specified twice (or more) in the header?

I experienced this problem as well. I decided not to worry about
catching the multiple subject lines, but to ensure that my tagging of
the subject line worked correctly and my users were seeing the
properly modified Subject line for SPAM messages.

Here's the link to the thread, and my modified
mimedefang-filter. I can add that since implementation (nine months
ago) I have had no false positives on this method.

http://lists.roaringpenguin.com/pipermail/mimedefang/2005-September/027960.html


....Sean

-- 
Sean Ware                          Midway Amusement Games, LLC
Senior Network Engineer                  2727 W. Roscoe Street
Information Technology Department       Chicago, IL 60618-5909
sware at midwaygames.com                           (773) 961-2000