#650625 spamassassin: FORGED_MUA_OUTLOOK false positive

Package:
spamassassin
Source:
spamassassin
Submitter:
Martin von Wittich
Date:
2011-12-07 17:33:03 UTC
Severity:
normal
#650625#5
Date:
2011-12-01 13:02:31 UTC
From:
To:
The attached mail (I've redacted the body and the from/to local parts) is sent
with Outlook via a legitimate Windows Exchange server, but SpamAssassin marks
it as FORGED_MUA_OUTLOOK. Looks to me like the Message-ID has a format that the
SA rules don't recognize?

Attachments:
- mail.txt: source code of the affected mail
- debug.txt: output of `cat mail.txt | spamassassin -D`
#650625#10
Date:
2011-12-07 17:09:02 UTC
From:
To:
Yep, I think your analysis is right.  The __IMS_MUA rule should have
fired, which would have marked this as a valid IMS message.  If it had
fired, then this would not have:
meta __FORGED_OUTLOOK_DOLLARS   (__OUTLOOK_DOLLARS_MUA && !__OE_MSGID_2 && !__OUTLOOK_DOLLARS_OTHER && !__VISTA_MSGID && !__IMS_MSGID && !__UNUSABLE_MSGID)

which would in turn make this one not fire:

meta FORGED_MUA_OUTLOOK         ((__FORGED_OE || __FORGED_OUTLOOK_DOLLARS) && !__FMO_EXCL_O3416 && !__FMO_EXCL_OE3790 && !__VISTA_MSGID)

I can confirm that this fp is still present the latest ruleset from
sa-update.  I'll follow up with upstream.

noah