Malformed attachments from MailScanner?

Jason Summers jason at MED-WEB.COM
Fri Apr 19 18:17:44 IST 2002


I'm noticing a problem with some messages that have had attachments
removed by MailScanner. It appears that sometimes a bogus blank line is
being created after a MIME boundary. This is especially common with
messages containing the Klez virus (maybe triggered by two consecutive
boundary lines in the source message?). Viewing the source of such a
message after MailScanner processing, I see something like this this:

----------------------
...
At Mon Apr 15 18:04:46 2002 the virus scanner said:
   >>> Virus 'W32/Klez-E' found in file ./SAA24934/Aqq.exe

Note to Help Desk: Look on the MailScanner in
/var/spool/MailScanner/quaran=
tine (message SAA24934).

--F5tQ38jj004znQ

Content-Type: application/octet-stream;
        name=MSOE.TXT
Content-Transfer-Encoding: base64
Content-ID: <Wi1Ny441h56355a>

ICAgIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLQ0KICAgICAgICBM6WFtZSBkZSBNaWNyb3NvZnQgT3V0bG9vayhUTSkgRXhw
...
----------------------

Note the blank line after "--F5tQ38jj004znQ".

Email clients will then not process the headers of that Part, and
instead typically treat them as the beginning of a plain text
attachment. In a multipart/alternative message, this undecoded gibberish
may be the *only* Part of the message thing that some mail clients will
display. Such a message is sure to be very confusing to most end users.

Am I the only one who has this problem? Can anyone suggest anything that
might improve the situation? (I'm using MailScanner 3.13-2 and
MIME-tools 5.411.)

--
Jason Summers



More information about the MailScanner mailing list