Malformed attachments from MailScanner?
Jason Summers
jason at MED-WEB.COM
Fri Apr 19 18:17:44 IST 2002
I'm noticing a problem with some messages that have had attachments
removed by MailScanner. It appears that sometimes a bogus blank line is
being created after a MIME boundary. This is especially common with
messages containing the Klez virus (maybe triggered by two consecutive
boundary lines in the source message?). Viewing the source of such a
message after MailScanner processing, I see something like this this:
----------------------
...
At Mon Apr 15 18:04:46 2002 the virus scanner said:
>>> Virus 'W32/Klez-E' found in file ./SAA24934/Aqq.exe
Note to Help Desk: Look on the MailScanner in
/var/spool/MailScanner/quaran=
tine (message SAA24934).
--F5tQ38jj004znQ
Content-Type: application/octet-stream;
name=MSOE.TXT
Content-Transfer-Encoding: base64
Content-ID: <Wi1Ny441h56355a>
ICAgIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLQ0KICAgICAgICBM6WFtZSBkZSBNaWNyb3NvZnQgT3V0bG9vayhUTSkgRXhw
...
----------------------
Note the blank line after "--F5tQ38jj004znQ".
Email clients will then not process the headers of that Part, and
instead typically treat them as the beginning of a plain text
attachment. In a multipart/alternative message, this undecoded gibberish
may be the *only* Part of the message thing that some mail clients will
display. Such a message is sure to be very confusing to most end users.
Am I the only one who has this problem? Can anyone suggest anything that
might improve the situation? (I'm using MailScanner 3.13-2 and
MIME-tools 5.411.)
--
Jason Summers
More information about the MailScanner
mailing list