[ale] Date grossly in the future

Wed May 18 11:19:26 EDT 2011

SpamAssasin has a rule that messages from "the future" are more likely
to be spam.  However, it bases "the future" off a simple date regex.
Until June 2009, it treated anything 2010 and later as being "the
future".[1]  According to your headers, it is being processed by
SpamAssassin 3.2.5 from 2008.   Thus, 2010+ years are considered spam.
 The fix wasn't even backported to 3.2. series of SA until 2010 when
it started blowing things up.[2]

[1] https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5852
[2] https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6269

David

On Wed, May 18, 2011 at 10:32 AM, Chris Fowler
<cfowler at outpostsentinel.com> wrote:
> I'm having some issues with a lot of legit email showing up in my spam
> folder.  I may need to bump up the score requirement in spamassasin
>
> Here is one I just found
> -----------------------------------------------------------------------------------------
> Return-path: <dave.steier at bellsouth.net>
> X-spam-flag: YES
> X-spam-checker-version: SpamAssassin 3.2.5 (2008-06-10) on
> support.opsdc.com
> X-spam-level: ********
> X-spam-status: Yes, score=8.4 required=6.0 tests=AWL,BAYES_99,
> FH_DATE_PAST_20XX,HTML_MESSAGE,MSGID_MULTIPLE_AT,UNPARSEABLE_RELAY
> autolearn=no version=3.2.5
> X-spam-report: *  3.5 BAYES_99 BODY: Bayesian spam probability is 99 to
> 100% *      [score: 1.0000] *  1.4 MSGID_MULTIPLE_AT Message-ID contains
> multiple '@' characters *  3.2 FH_DATE_PAST_20XX The date is grossly in
> the future. *  0.0 UNPARSEABLE_RELAY Informational: message has
> unparseable relay lines *  0.0 HTML_MESSAGE BODY: HTML included in
> message *  0.3 AWL AWL: From: address is in the auto white-list
> Received: from omp1026.access.mail.mud.yahoo.com
> (omp1026.access.mail.mud.yahoo.com [66.94.237.121]) by support.opsdc.com
> (8.13.8/8.13.8) with SMTP id p4GNcEDE018903 for <cfowler at opsdc.com>;
> Mon, 16 May 2011 19:38:14 -0400
> Received: (qmail 59052 invoked by uid 1000); 16 May 2011 23:38:14 -0000
> Received: (qmail 81348 invoked from network); 16 May 2011 23:38:08 -0000
> Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bellsouth.net;
> s=s1024; t=1305589087; bh=5L0zVdajX5XzjQvWwyhsRJRzkE69SAlj+vdvbMSr7R0=;
> h=Received:X-Yahoo-SMTP:X-YMail-OSG:X-Yahoo-Newman-Property:From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:X-Mailer:Thread-Index:Content-Language; b=y8G/UDFaVddWWX3N6KwN3RLBbeR1mZdlP/GIQYJIC77cA7KQ1pPNWYL1PyeTSZusI6j4FhqvId8jfrRUPaQmWd6c0orwa6G7FA8XpgLxxBwMNuHCiPeW4X8xwG1HvHycoXksUJENYT6d2oBaxdX+WoIY6uEUKHGVU4/9XGUl3Nw=
> Received: from DavePC (dave.steier at 99.104.190.94 with login) by
> smtp103.sbc.mail.bf1.yahoo.com with SMTP; 16 May 2011 16:37:35 -0700 PDT
> X-yahoo-smtp: S1fnLv6swBDDWBkI4TDU2cVlBX7j75ndP3.vGjtNu0FmCL4O7y0-
> X-ymail-osg: 6Hht_UcVM1lE994OKYBUnbxPiP7jYkxqAzfslEV8VacOdfq
> YDd0Ysyg1.gu1DVc5Xm0hd0DsJ__xNo0idft2gwAsqRKb.j0rgDHZC0ctr4k
> _Z74mKxcY5LUagCIPJzOymzTSeGbDaLM051v2W7Z9HcSvqB7d2pKfFbqOg9f
> 3KVk0X_WAf9HRZwrw8_MI9rS8eCaoTqQ1QHwVMleZ8Pn8UiAhloDKOVVbM8W
> 5jH1dUR5MntZyFhnwA6wCR6Wh5G2y6RfgUa39FC7y_ofVuLqdyqu9NIrt9l4
> iDbmkYfqCu5b2qQwlaXxZaon5INSQTqZQZ2gePh68G5wJ3bnKZ10_q60bESk abK9gnJs-
> X-yahoo-newman-property: ymail-3
> From: Dave Steier <dave.steier at bellsouth.net>
> To: cfowler at opsdc.com
> Subject: [SPAM] New Puppy
> Date: Mon, 16 May 2011 19:37:57 -0400
> Message-id: <017801cc1422$497a09c0$dc6e1d40$@steier at bellsouth.net>
> Mime-version: 1.0
> Content-type: multipart/mixed;
> boundary="----=_NextPart_000_0179_01CC1400.C26890D0"
> X-mailer: Microsoft Office Outlook 12.0
> Thread-index: AcwUIkj/gELT13K7TNm2fWVgL3Viqg==
> Content-language: en-us
> X-spam-prev-subject: New Puppy
> X-evolution-source: imap://cfowler@192.168.100.1/
> -----------------------------------------------------------------------------------------
>
> I do not understand where this is coming from:
>
> 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
>

-- 
David Tomaschik, RHCE, LPIC-1
System Administrator/Open Source Advocate
OpenPGP: 0x5DEA789B
http://systemoverlord.com
david at systemoverlord.com