Bad SMTP headers

On RT 2.0.7, getting these errors in qmail log:

@400000003bb662130613427c delivery 198: success:
Bad_RFC822_field_name_'The_Box_Immediately_To_Dan’S_Left_As_He_Sits_At_H
is_Temrinal_Is_Dead.I_Use’/at/opt/rt2/lib/RT/Template.pm_line_255/did
0+0+1/
@400000003bb867c8312c5354 delivery 1: success:
Bad_RFC822_field_name
’Good_Morning
-’/at/opt/rt2/lib/RT/Template.pm
line_255/did_0+0+1/
@400000003bb8865937ec2b74 delivery 4: success:
Bad_RFC822_field_name_‘Please_Find_Attached_File_For_Your_Review.’/at/
opt/rt2/lib/RT/Template.pm_line_255/did_0+0+1/

Looks like RT is considering part of the message body to be headers.

-Phil Oester

That is the SirCam Virus being sent to your mail server.

Stephen Hauskins
Academic Computing Group
Natural Sciences Division

"Blow, blow, thou winter wind,
Thou art not so unkind
As man’s ingratitude;"On Mon, 1 Oct 2001, Phil Oester wrote:

On RT 2.0.7, getting these errors in qmail log:

@400000003bb662130613427c delivery 198: success:
Bad_RFC822_field_name_'The_Box_Immediately_To_Dan’S_Left_As_He_Sits_At_H
is_Temrinal_Is_Dead.I_Use’/at/opt/rt2/lib/RT/Template.pm_line_255/did
0+0+1/
@400000003bb867c8312c5354 delivery 1: success:
Bad_RFC822_field_name
’Good_Morning
-’/at/opt/rt2/lib/RT/Template.pm
line_255/did_0+0+1/
@400000003bb8865937ec2b74 delivery 4: success:
Bad_RFC822_field_name_‘Please_Find_Attached_File_For_Your_Review.’/at/
opt/rt2/lib/RT/Template.pm_line_255/did_0+0+1/

Looks like RT is considering part of the message body to be headers.

-Phil Oester


rt-users mailing list
rt-users@lists.fsck.com
http://lists.fsck.com/mailman/listinfo/rt-users

| That is the SirCam Virus being sent to your mail server.
±–>8

Sircam is actually relatively well behaved; it’s Nimda that sends mangled
messages, in my experience.

brandon s. allbery [os/2][linux][solaris][freebsd] allbery@kf8nh.apk.net
system administrator [JAPH][WAY too many hats] allbery@ece.cmu.edu
electrical and computer engineering KF8NH
carnegie mellon university [linux: proof of the million monkeys theory]

It has a funny look to it, in the sense that it appears as
though it were a string being fed to web server- i.e. nimda

On the other hand, SirCam virus messages always have that classic
line, “I have enclosed this document for you to review”, and that is
not a direct quote.

Stephen Hauskins
Academic Computing Group
Natural Sciences Division

"Blow, blow, thou winter wind,
Thou art not so unkind
As man’s ingratitude;"On Mon, 1 Oct 2001, Brandon S. Allbery KF8NH wrote:

On Monday, October 01, 2001 16:53:19 -0700, stephen@acgroup.ucsc.edu wrote:
±----
| That is the SirCam Virus being sent to your mail server.
±–>8

Sircam is actually relatively well behaved; it’s Nimda that sends mangled
messages, in my experience.


brandon s. allbery [os/2][linux][solaris][freebsd] allbery@kf8nh.apk.net
system administrator [JAPH][WAY too many hats] allbery@ece.cmu.edu
electrical and computer engineering KF8NH
carnegie mellon university [linux: proof of the million monkeys theory]


rt-users mailing list
rt-users@lists.fsck.com
http://lists.fsck.com/mailman/listinfo/rt-users

| On the other hand, SirCam virus messages always have that classic
| line, “I have enclosed this document for you to review”, and that is
| not a direct quote.
±–>8

“I send you this file” “in order to have your advice”
(guess who’s gotten too d*mned many copies of it…)
(weird quoting just in case someone’s virus scanner is hyperactive :slight_smile:

brandon s. allbery [os/2][linux][solaris][freebsd] allbery@kf8nh.apk.net
system administrator [JAPH][WAY too many hats] allbery@ece.cmu.edu
electrical and computer engineering KF8NH
carnegie mellon university [linux: proof of the million monkeys theory]