Could not analyze report?

[Randal, Phil]

Well, breaking it into smaller batches to narrow down where it is breaking
still seems a good idea to me.

Phil

---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK 

> -----Original Message-----
> From: Stephe Campbell [mailto:campbell at CNPAPERS.COM]
> Sent: 10 October 2003 16:21
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Could not analyze report?
> 
> 
> Really sorry this is taking up so much of the list resources. 
> To be honest,
> I think I'll tell her to just use what's in her Sent Folder, 
> which has what
> is received anyway until something starts pointing to an answer.
> 
> I had also considered this suggestion of batches, but the 
> number of leftout
> emails versus the number included did not warrant any real 
> clues, since this
> normally worked before. The web form is not subject to 
> injection by anything
> obvious to us as we have tried to make it as clean as 
> possible, even to
> restrict the type of POST/GET we allow for this. In some respects, its
> almost like SA has something new in it that is causing MS to 
> cough, since
> this has only started since the MS/SA upgrade last week. But 
> you really
> never know if anything else has changed, so that is just 
> speculative. Maybe
> someone is putting some garbage in the form.
> 
> My only concern is that this may be something simple and 
> common, and if an
> answer can be found, it may help someone else down the road.
> 
> 
> ----- Original Message ----- 
> From: "Randal, Phil" <prandal at HEREFORDSHIRE.GOV.UK>
> To: <MAILSCANNER at JISCMAIL.AC.UK>
> Sent: Friday, October 10, 2003 10:44 AM
> Subject: Re: Could not analyze report?
> 
> 
> Any chance that the form is vulnerable to html injection etc? 
>  Have you
> checked through the batch of emails to see if there is some 
> dodgy data in
> it?
> 
> Why don't you get her to batch it in lots of 50 and see if 
> any of those
> bundles get blocked?
> 
> Phil
> 
> ---------------------------------------------
> Phil Randal
> Network Engineer
> Herefordshire Council
> Hereford, UK
> 
> > -----Original Message-----
> > From: Stephe Campbell [mailto:campbell at CNPAPERS.COM]
> > Sent: 10 October 2003 15:39
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: Could not analyze report?
> >
> >
> > She does use folders. But these emails all come into that folder
> > individually, and she needs the body (results of the web form
> > from 400+
> > different people - it's kind of a survey) of all of these 
> in one Word
> > document. She then deletes the HTML and gets a count of the 
> individual
> > senders plus their web form results and some other stuff.
> > It's a simple way
> > of doing this without databases and programming and debugging
> > and retest,
> > ......
> >
> > Steve Campbell
> > campbell at cnpapers.com
> > Charleston Newspapers
> >
> > ----- Original Message ----- 
> > From: "Ugo Bellavance" <ugob at CAMO-ROUTE.COM>
> > To: <MAILSCANNER at JISCMAIL.AC.UK>
> > Sent: Friday, October 10, 2003 10:22 AM
> > Subject: Re: Could not analyze report?
> >
> >
> > > -----Message d'origine-----
> > > De : Stephe Campbell [mailto:campbell at CNPAPERS.COM]
> > > Envoyé : Friday, October 10, 2003 10:21 AM
> > > À : MAILSCANNER at JISCMAIL.AC.UK
> > > Objet : Re: Could not analyze report?
> > >
> > >
> > > I am running the latest versions of both MS & SA.
> > >
> > > As to Mr. Hirsh:
> > >    I am not sure these are considered attachments because
> > > they are received
> > > as one long body. I had considered that though and have the
> > > default set to
> > > 200. I could up this just to see if this is what is really
> > doing this
> > > though.
> > >
> > > As to Mr. Spicer:
> > >    I assume these are 400+ inline parts of one body. This is
> > > the way is has
> > > alway been performed and has worked. The output of the form
> > > is actually only
> > > a few lines with the encapsulating HTML around it ( the
> > > common BODY, HEAD
> > > stuff, nothing fancy). The quarantined part of the email
> > > lands in quarantine
> > > as a file named 'message' and has all of the individual
> > stuff that is
> > > supposed to be forwarded.
> > >
> > > As to Mr. Bellavance:
> > >    This is her quick and easy way to combine 400+ emails into
> > > one email
> > > body. It actually works quite well, with the exception of now
> > > it doesn't.
> > >
> > > BTW, as usual, I forgot to mention the Subject in the
> > sysadmin report
> > > indicates : Warning: E-mail viruses detected. This is
> > > throwing me a little
> > > as to what direction to lean.
> > >
> > > As best as I could find, this Subject line is kind of generic.
> > >
> > > Thanks
> > >
> > > Steve Campbell
> > > campbell at cnpapers.com
> > > Charleston Newspapers
> > >
> >
> > It is probably that one of the message has dangerous HTML
> > that is considered
> > as a virus.  No attachment ot the sysadmin report?
> >
> > It is quite a weird way to manage messages.  I hope she
> > doesn't do that with
> > her ISP too.
> >
> > Why doesn't she use folders ? :)
> >
>