ZIP file attachments passing through MS 4.35.9 unscanned

[Adri Koppes]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian,

Thanks.
The patch solved the problem and 'hidden' zipfiles are now scanned.

Adri.

> -----Original Message-----
> From: Julian Field [mailto:mailscanner at ECS.SOTON.AC.UK]
> Sent: 21 December, 2004 15:09
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: ZIP file attachments passing through MS 4.35.9 unscanned
>
>
> Please try the attached patch to Message.pm.
>
> Adri Koppes wrote:
>
> >>-----Original Message-----
> >>From: Mike [mailto:michael at NOMENNESCIO.NET]
> >>Sent: 21 December, 2004 13:38
> >>To: MAILSCANNER at JISCMAIL.AC.UK
> >>Subject: Re: ZIP file attachments passing through MS 4.35.9
> unscanned
> >>
> >>
> >>
> >>
> >>>From: MailScanner mailing list
> >>>
> >>>
> >>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> >>
> >>
> >>>Behalf Of Adri Koppes
> >>>
> >>>Recently I have noticed some people bypassing the contents
> >>>
> >>>
> >>scanning of
> >>Zip
> >>
> >>
> >>>file attachments.
> >>>When a message contains a .zip file attachment, renamed to .txt,
> >>>MailScanner does not seems to detect the presence of the zip file,
> >>>
> >>>
> >>despite > the setting of 'Find Archives By Content = yes' in the
> >>MailScanner.conf   > file. Examing the message, the zip file
> >>is attached
> >>as follows:
> >>
> >>
> >>>Has anyone else noticed this problem? It is real easy to pass
> >>>
> >>>
> >>executables
> >>
> >>
> >>>and other mallicious content.
> >>>
> >>>
> >>Use this option in MailScanner.conf:  "File Command =
> /usr/bin/file".
> >>
> >>
> >
> >I already have that set and verified it's working. For
> instance MPEG's and
> >AVI's are blocked regardless of the attached filename.
> >
> >Adri
> >
> >
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!