Could not analyze report?

Stephe Campbell campbell at CNPAPERS.COM
Fri Oct 10 16:20:36 IST 2003


Really sorry this is taking up so much of the list resources. To be honest,
I think I'll tell her to just use what's in her Sent Folder, which has what
is received anyway until something starts pointing to an answer.

I had also considered this suggestion of batches, but the number of leftout
emails versus the number included did not warrant any real clues, since this
normally worked before. The web form is not subject to injection by anything
obvious to us as we have tried to make it as clean as possible, even to
restrict the type of POST/GET we allow for this. In some respects, its
almost like SA has something new in it that is causing MS to cough, since
this has only started since the MS/SA upgrade last week. But you really
never know if anything else has changed, so that is just speculative. Maybe
someone is putting some garbage in the form.

My only concern is that this may be something simple and common, and if an
answer can be found, it may help someone else down the road.


----- Original Message ----- 
From: "Randal, Phil" <prandal at HEREFORDSHIRE.GOV.UK>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Friday, October 10, 2003 10:44 AM
Subject: Re: Could not analyze report?


Any chance that the form is vulnerable to html injection etc?  Have you
checked through the batch of emails to see if there is some dodgy data in
it?

Why don't you get her to batch it in lots of 50 and see if any of those
bundles get blocked?

Phil

---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: Stephe Campbell [mailto:campbell at CNPAPERS.COM]
> Sent: 10 October 2003 15:39
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Could not analyze report?
>
>
> She does use folders. But these emails all come into that folder
> individually, and she needs the body (results of the web form
> from 400+
> different people - it's kind of a survey) of all of these in one Word
> document. She then deletes the HTML and gets a count of the individual
> senders plus their web form results and some other stuff.
> It's a simple way
> of doing this without databases and programming and debugging
> and retest,
> ......
>
> Steve Campbell
> campbell at cnpapers.com
> Charleston Newspapers
>
> ----- Original Message ----- 
> From: "Ugo Bellavance" <ugob at CAMO-ROUTE.COM>
> To: <MAILSCANNER at JISCMAIL.AC.UK>
> Sent: Friday, October 10, 2003 10:22 AM
> Subject: Re: Could not analyze report?
>
>
> > -----Message d'origine-----
> > De : Stephe Campbell [mailto:campbell at CNPAPERS.COM]
> > Envoyé : Friday, October 10, 2003 10:21 AM
> > À : MAILSCANNER at JISCMAIL.AC.UK
> > Objet : Re: Could not analyze report?
> >
> >
> > I am running the latest versions of both MS & SA.
> >
> > As to Mr. Hirsh:
> >    I am not sure these are considered attachments because
> > they are received
> > as one long body. I had considered that though and have the
> > default set to
> > 200. I could up this just to see if this is what is really
> doing this
> > though.
> >
> > As to Mr. Spicer:
> >    I assume these are 400+ inline parts of one body. This is
> > the way is has
> > alway been performed and has worked. The output of the form
> > is actually only
> > a few lines with the encapsulating HTML around it ( the
> > common BODY, HEAD
> > stuff, nothing fancy). The quarantined part of the email
> > lands in quarantine
> > as a file named 'message' and has all of the individual
> stuff that is
> > supposed to be forwarded.
> >
> > As to Mr. Bellavance:
> >    This is her quick and easy way to combine 400+ emails into
> > one email
> > body. It actually works quite well, with the exception of now
> > it doesn't.
> >
> > BTW, as usual, I forgot to mention the Subject in the
> sysadmin report
> > indicates : Warning: E-mail viruses detected. This is
> > throwing me a little
> > as to what direction to lean.
> >
> > As best as I could find, this Subject line is kind of generic.
> >
> > Thanks
> >
> > Steve Campbell
> > campbell at cnpapers.com
> > Charleston Newspapers
> >
>
> It is probably that one of the message has dangerous HTML
> that is considered
> as a virus.  No attachment ot the sysadmin report?
>
> It is quite a weird way to manage messages.  I hope she
> doesn't do that with
> her ISP too.
>
> Why doesn't she use folders ? :)
>




More information about the MailScanner mailing list