[RndTbl] SpamAssassin false positives on DATE_IN_FUTURE_96_Q?

[Kevin McGregor]

So you've changed the date manually to be exactly the same, and the rule
doesn't trigger?

On Mon, Nov 14, 2011 at 4:56 PM, Gilbert E. Detillieux <
gedetil at cs.umanitoba.ca> wrote:

> I mentioned this problem at the last round-table session, but didn't get a
> solution, so I thought I'd post it here, just in case anyone has any
> suggestions to offer.
>
> I'm still seeing a whole bunch of false positives in SpamAssassin, since
> an update was installed in mid-September on a CentOS 5.7 system, for a rule
> called DATE_IN_FUTURE_96_Q, which is only supposed to be triggered when the
> "Date:" header has a date that is 4 days to 4 month ahead of the date in
> the "Received" header that has the _smallest_ difference in date.
>
> Here are the headers from the latest e-mail I've received with this
> false-positive.  (I've stripped out irrelevant headers, for the sake of
> clarity and simplicity.)
>
> From topfivestories at messagent.**itworldcanada.com<topfivestories at messagent.itworldcanada.com> Mon Nov 14 07:50:13 2011
> Received: from mail.messagent.itworldcanada.**com<http://mail.messagent.itworldcanada.com>(
> mail.messagent.itworldcanada.**com<http://mail.messagent.itworldcanada.com>[207.112.10.80])
>        by palladium.cs.umanitoba.ca (8.13.8/8.13.8) with SMTP id
> pAEDoAxV028594
>        for <gedetil at cs.umanitoba.ca>; Mon, 14 Nov 2011 07:50:12 -0600
> Date: Mon, 14 Nov 2011 08:50:13 -0500
> X-Spam-Status: No, score=-0.3 required=5.0 tests=BAYES_00,DATE_IN_FUTURE_*
> *96_Q,
>        HTML_MESSAGE,RP_MATCHES_RCVD autolearn=no version=3.3.1
> X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
>        palladium.cs.umanitoba.ca
>
> Note that I'm calling spamd via the spamass-milter on a system running
> sendmail.  Note also, that in the above example, the only "Received" header
> was the one generated by my own server.  (I've had other false positives,
> however, with multiple "Received" headers, all of which were within seconds
> of the time in the "Date" header.)
>
> Any ideas?
>
> --
> Gilbert E. Detillieux           E-mail: <gedetil at muug.mb.ca>
> Manitoba UNIX User Group        Web:    http://www.muug.mb.ca/
> PO Box 130 St-Boniface          Phone:  (204)474-8161
> Winnipeg MB CANADA  R2H 3B4     Fax:    (204)474-7609
> ______________________________**_________________
> Roundtable mailing list
> Roundtable at muug.mb.ca
> http://www.muug.mb.ca/mailman/**listinfo/roundtable<http://www.muug.mb.ca/mailman/listinfo/roundtable>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.muug.mb.ca/pipermail/roundtable/attachments/20111114/3a6fac4d/attachment.html>