Lost text and attachments (Eudora+Cyrus issue)

[Brad Patterson]

I have a customer at Cisco who is sending attachments to several of our users.  I can see from
the headers that the sender uses Eudora version 4.3.2 for Windows and that he is sending
through a Mirapoint mail server (IMAP).  The message he is sending is HTML with two
attachments, one is a log file and the other is a zip file.  Total size of the message is approx.
200 KB.

In my syslog, I see the message arrive, size is 205388 and MailScanner grabs the message for
spam and virus checks, then passes the message on to our Notes server.  No spam or virus
are detected, but the email is empty (no text or attachments) beyond the headers and the
following message is logged:

May 15 16:03:58 smtp4.xxx.com MailScanner[16114]: Content Checks: Fixed awkward MIME
boundary for Cyrus IMAP server in h4FL3qKr017067

Looking back through my old list messages, I see that somebody asked a similar question
about Eudora+Cyrus MIME issues.  After poking around the configuration and doing some
research, I'm not sure how/where to resolve this issue.

It looks like MailScanner gets to the point where the Cyrus message is logged, then stops
processing and only sends the message headers.  None of the X-MailScanner headers appear
in the message.

At the moment, I don't know the confidentiality status of the attachments in question, so I
can't include them for analysis.  They are plain text log files.

MailScanner 4.20-3
Perl 5.8.0
ClamAV (snapshot 20030317)
Solaris 9
All of the perl modules are the versions listed on the mailscanner.info web site.


My questions:
Has anyone else seen this type of behavior (empty message)?
Any ideas of how to resolve it?
Any additional information I should post?

--
Brad Patterson

P.S. - I know it's usually bad form to include an entirely different message, but I thought it
might jog somebody's memory.


On 1/10/03 16:14, "Julian Field" <mailscanner at ECS.SOTON.AC.UK> wrote:

> This is a result of a check used to defend against a bug in the Cyrus IMAP
> server which is exercised by some versions of Eudora. You have a
> multipart/mixed with a multipart/alternative inside it, where the "mised"
> MIME boundary is a substring of the "alternative" MIME boundary.
>
> So when MailScanner finds this situation, it changes the inner MIME
> boundary to be the string you saw. However, I did test this and it worked
> just fine when I tested it...
> Are you using the latest MIME tools and so on?
>
> It will only happen to messages created with Eudora which contain "styled"
> text (i.e. HTML) as well as plain text, and an attachment.
> Is anyone else seeing this problem?
> Or could it be a majordomo problem? The fact that it doesn't occur in
> messages sent to individual users shows it must be at least mostly correct.
>
> Can you send me (zipped up) the complete message sent to individual users,
> and the message sent out by majordomo, so I can compare them please?
>
> At 21:52 10/01/2003, you wrote:
>> Hello,
>>
>> We are running version 4.11-1 of mailscanner on HP-UX 11.0 with sendmail
>> 8.12.7, Qpopper and majordomo as our mailing list manager.  When a Word file
>> was sent as an attachemnt to a majordomo list it resulted in the following
>> error:  _MailScanner_found_Cyrus_boundary_substring_problem__
>> and the attachment was included in the message.  When the same attachment is
>> sent to individual users it is deliverd normally.
>> The sender uses Eudora on Windows 2000.
>>
>> Does anyone know what the problem might be?
>>
>>> --=====================_366438080==_.ALT--
>>>
>> --__MailScanner_found_Cyrus_boundary_substring_problem__
>> Content-Type: application/msword; name="serials survey 1-03.doc";
>>  x-mac-type="42494E41"; x-mac-creator="4D535744"
>> Content-Transfer-Encoding: base64>Content-Disposition: attachment;
>> filename="serials survey 1-03.doc"
>> 0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAAB
>> AAAAQwAAAAAAAAAAEAAARQAAAAEAAAD+////AAAAAEIAAAD/////////////
>>
>> etc.
>>
>> Thanks
>> Johannes Johannsson