Malformed attachments from MailScanner?

Mon Apr 22 12:47:31 IST 2002

I've noticed this behaviour too (running MIME-tools 5.403

If I edit out the attachment, and decode it, it's a webpage
starting

<HTML>
<HEAD>
<TITLE>MIME::Base64 - Encoding and decoding of base64 strings</TITLE>
<LINK REV="made" HREF="mailto:">
                <link rel="stylesheet" href="../../../win32prk.css"
type="text/css">
</HEAD>
        <BODY BGCOLOR="FFFFFF">
        <!-- beginning of leaf header-->

        <TABLE border=0  cellpadding=0 cellspacing=0 width=100%>


--------
Alan Stanier
Essex University Information Systems Services
Systems Group


> -----Original Message-----
> From: Julian Field [mailto:jkf at ECS.SOTON.AC.UK]
> Sent: 20 April 2002 11:04
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Malformed attachments from MailScanner?
>
>
> Are you running the latest MIME-tools? I haven't seen this
> happen myself.
>
> At 18:17 19/04/2002, you wrote:
> >I'm noticing a problem with some messages that have had attachments
> >removed by MailScanner. It appears that sometimes a bogus
> blank line is
> >being created after a MIME boundary. This is especially common with
> >messages containing the Klez virus (maybe triggered by two
> consecutive
> >boundary lines in the source message?). Viewing the source of such a
> >message after MailScanner processing, I see something like this this:
> >
> >----------------------
> >...
> >At Mon Apr 15 18:04:46 2002 the virus scanner said:
> >    >>> Virus 'W32/Klez-E' found in file ./SAA24934/Aqq.exe
> >
> >Note to Help Desk: Look on the MailScanner in
> >/var/spool/MailScanner/quaran=
> >tine (message SAA24934).
> >
> >--F5tQ38jj004znQ
> >
> >Content-Type: application/octet-stream;
> >         name=MSOE.TXT
> >Content-Transfer-Encoding: base64
> >Content-ID: <Wi1Ny441h56355a>
> >
> >ICAgIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
> S0tLS0tLS0t
> >LS0tLS0tLS0tLQ0KICAgICAgICBM6WFtZSBkZSBNaWNyb3NvZnQgT3V0bG9va
> yhUTSkgRXhw
> >...
> >----------------------
> >
> >Note the blank line after "--F5tQ38jj004znQ".
> >
> >Email clients will then not process the headers of that Part, and
> >instead typically treat them as the beginning of a plain text
> >attachment. In a multipart/alternative message, this
> undecoded gibberish
> >may be the *only* Part of the message thing that some mail
> clients will
> >display. Such a message is sure to be very confusing to most
> end users.
> >
> >Am I the only one who has this problem? Can anyone suggest
> anything that
> >might improve the situation? (I'm using MailScanner 3.13-2 and
> >MIME-tools 5.411.)
> >
> >--
> >Jason Summers
>
> --
> Julian Field                Teaching Systems Manager
> jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
> Tel. 023 8059 2817          University of Southampton
>                              Southampton SO17 1BJ
>