Multipart Mime attachment killing MailScanner again

Julian Field mailscanner at ecs.soton.ac.uk
Sat Mar 8 13:45:38 GMT 2003


At 21:13 07/03/2003, you wrote:
>Hi Julian,
>      I have encountered the problem of a single multi-part MIME 
> attachement message killing MailScanner.   Here again I will include the 
> error, however, I may have some more pertinent info.  I will try to 
> include the qf file here, and both in a tar.gz on an ftp server fo 
> you.  The error is as follows:

Can you give me the ftp location please?
Also, what version are you running?
What O/S are you running (and what version of that)?

>Mar  7 14:26:37 mail MailScanner[17955]: Cannot parse 
>/private/var/spool/MailScanner/incoming/17955/h27GA5sK025282.header and , 
>write-open 
>/private/var/spool/MailScanner/incoming/17955/h27GA5sK025282/LinkousGreen^@3x4^@.crtr: 
>Invalid argument at /Library/Perl/MIME/Body.pm line 414.
>
>One interesting thing to note is that I can't use the external TNEF 
>expander, as I am running on darwin Mac OS X.  Here is the related portion 
>of MailScanner.conf, for MailScanner 4.12-2.

Does it not compile correctly? The source distribution of tnef (with the 
"--maxsize" patch applied) is in the bin directory in the MailScanner 
distribution.

>   Also it is interesting to note that this message and the last one have 
> been sent from Microsoft Outlook Express for Mac containing a Multipart 
> mime message:
>
># Expand TNEF attachments using an external program (or a Perl module)?
># This should be "yes" unless the scanner you are using (Sophos, McAfee) has
># the facility built-in. However, if you set it to "no", then the filenames
># within the TNEF attachment will not be checked against the filename rules.
>Expand TNEF = yes
>
># Some versions of Microsoft Outlook generate unparsable Rich Text
># format attachments. Do we want to deliver these bad attachments anyway?
># Setting this to yes introduces the slight risk of a virus getting through,
># but if you have a lot of troubled Outlook users you might need to do this.
># We are working on a replacement for the TNEF decoder.
># This can also be the filename of a ruleset.
>Deliver Unparsable TNEF = no
>
># Where the MS-TNEF expander is installed.
># This is EITHER the full command (including maxsize option) that runs
># the external TNEF expander binary,
># OR the keyword "internal" which will make MailScanner use the Perl
># module that does the same job.
># They are both provided as I am unsure which one is faster and which
># one is capable of expanding more file formats (there are plenty!).
>#
># The --maxsize option limits the maximum size that any expanded attachment
># may be. It helps protect against Denial Of Service attacks in TNEF files.
>TNEF Expander    = internal
># This can also be the filename of a ruleset.
>#TNEF Expander = /opt/MailScanner/bin/tnef --maxsize=100000000
>
># The maximum length of time the TNEF Expander is allowed to run for 1 
>message.
># (in seconds)
>TNEF Timeout = 120
>
>
>Here is the qfh27GA5sK025282, quoted to hopefully get through the scanners:
>
> >V6
> >T1047053406
> >K0
> >N0
> >P30559
> >B8BITMIME
> >F8bs
> >$_znet.groupz.net [216.116.255.2]
> >$rESMTP
> >$sznet.groupz.net
> >${daemon_flags}
> >${if_addr}66.4.192.160
> >S<xxxxx at oakridger.com>
> >rRFC822; xxxxx at ortn.edu
> >RPFD:<xxxxx at ortn.edu>
> >H?P?Return-Path: <Åg>
> >H??Received: from znet.groupz.net (znet.groupz.net [216.116.255.2])
> >       by mail.ortn.edu (8.12.7/8.12.6) with ESMTP id h27GA5sK025282
> >       for <xxxxx at ortn.edu>; Fri, 7 Mar 2003 11:10:06 -0500 (EST)
> >H??Received: from [192.168.154.153] (fwp1016.groupz.net [216.116.243.254])
> >       by znet.groupz.net (8.8.6 (PHNE_14041)/8.8.8) with ESMTP id LAA21034
> >       for <xxxxx at ortn.edu>; Fri, 7 Mar 2003 11:09:54 -0500 (EST)
> >H??User-Agent: Microsoft Outlook Express Macintosh Edition - 5.01 (1630)
> >H??Date: Fri, 07 Mar 2003 11:08:59 -0500
> >H??Subject: jpeg - Linkous 3x4
> >H??From: xxxxx xxxxx <xxxxx at oakridger.com>
> >H??To: <xxxxx at ortn.edu>
> >H??Message-ID: <BA8E2E4B.F77%xxxxx at oakridger.com>
> >H??Mime-version: 1.0
> >H??Content-type: multipart/mixed;
> >   boundary="MS_Mac_OE_3129880139_20285474_MIME_Part"
> >.

-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support




More information about the MailScanner mailing list