Multipart Mime attachment killing MailScanner again

[Daniel Bowen]

Hi Julian,
     I have encountered the problem of a single multi-part MIME attachement message killing MailScanner.   Here again I will include the error, however, I may have some more pertinent info.  I will try to include the qf file here, and both in a tar.gz on an ftp server fo you.  The error is as follows:

Mar  7 14:26:37 mail MailScanner[17955]: Cannot parse /private/var/spool/MailScanner/incoming/17955/h27GA5sK025282.header and , write-open /private/var/spool/MailScanner/incoming/17955/h27GA5sK025282/LinkousGreen^@3x4^@.crtr: Invalid argument at /Library/Perl/MIME/Body.pm line 414. 

One interesting thing to note is that I can't use the external TNEF expander, as I am running on darwin Mac OS X.  Here is the related portion of MailScanner.conf, for MailScanner 4.12-2.  Also it is interesting to note that this message and the last one have been sent from Microsoft Outlook Express for Mac containing a Multipart mime message:

# Expand TNEF attachments using an external program (or a Perl module)?
# This should be "yes" unless the scanner you are using (Sophos, McAfee) has
# the facility built-in. However, if you set it to "no", then the filenames
# within the TNEF attachment will not be checked against the filename rules.
Expand TNEF = yes

# Some versions of Microsoft Outlook generate unparsable Rich Text 
# format attachments. Do we want to deliver these bad attachments anyway?
# Setting this to yes introduces the slight risk of a virus getting through,
# but if you have a lot of troubled Outlook users you might need to do this.
# We are working on a replacement for the TNEF decoder.
# This can also be the filename of a ruleset.
Deliver Unparsable TNEF = no

# Where the MS-TNEF expander is installed.
# This is EITHER the full command (including maxsize option) that runs
# the external TNEF expander binary,
# OR the keyword "internal" which will make MailScanner use the Perl
# module that does the same job.
# They are both provided as I am unsure which one is faster and which     
# one is capable of expanding more file formats (there are plenty!).       
#       
# The --maxsize option limits the maximum size that any expanded attachment
# may be. It helps protect against Denial Of Service attacks in TNEF files.
TNEF Expander    = internal
# This can also be the filename of a ruleset.
#TNEF Expander = /opt/MailScanner/bin/tnef --maxsize=100000000

# The maximum length of time the TNEF Expander is allowed to run for 1 message.
# (in seconds)   
TNEF Timeout = 120


Here is the qfh27GA5sK025282, quoted to hopefully get through the scanners:

>V6
>T1047053406
>K0
>N0
>P30559
>B8BITMIME
>F8bs
>$_znet.groupz.net [216.116.255.2]
>$rESMTP
>$sznet.groupz.net
>${daemon_flags}
>${if_addr}66.4.192.160
>S<xxxxx at oakridger.com>
>rRFC822; xxxxx at ortn.edu
>RPFD:<xxxxx at ortn.edu>
>H?P?Return-Path: <Åg>
>H??Received: from znet.groupz.net (znet.groupz.net [216.116.255.2])
>	by mail.ortn.edu (8.12.7/8.12.6) with ESMTP id h27GA5sK025282
>	for <xxxxx at ortn.edu>; Fri, 7 Mar 2003 11:10:06 -0500 (EST)
>H??Received: from [192.168.154.153] (fwp1016.groupz.net [216.116.243.254])
>	by znet.groupz.net (8.8.6 (PHNE_14041)/8.8.8) with ESMTP id LAA21034
>	for <xxxxx at ortn.edu>; Fri, 7 Mar 2003 11:09:54 -0500 (EST)
>H??User-Agent: Microsoft Outlook Express Macintosh Edition - 5.01 (1630)
>H??Date: Fri, 07 Mar 2003 11:08:59 -0500
>H??Subject: jpeg - Linkous 3x4
>H??From: xxxxx xxxxx <xxxxx at oakridger.com>
>H??To: <xxxxx at ortn.edu>
>H??Message-ID: <BA8E2E4B.F77%xxxxx at oakridger.com>
>H??Mime-version: 1.0
>H??Content-type: multipart/mixed;
>   boundary="MS_Mac_OE_3129880139_20285474_MIME_Part"
>.