Problem with blocked jpg file

[Jim Holland]

Hi Julian

I think this is in your department.

I was puzzled by a message whose jpg attachment was blocked with error:

	MailScanner: No scripts (Group_05221.jpg)

The file is just a jpg, and clamscan can't see anything wrong with it.  It 
doesn't seem to contain any script, although it has the following header:

.....JFIF...HH...ZImageDescription           :
Make                       : SONY
Model                      : CYBERSHOT
ExposureTime               : 0.025000
FNumber                    : 2.800000
ExposureProgram            : 2
ISOSpeedRatings            : 160
CompressedBitsPerPixel     : 2.000000
ExposureBiasValue          : 0.000000
MaxApertureValue           : 3.000000
MeteringMode               : 2
LightSource                : 0
Flash                      : 1
FocalLength                : 8.000000
MakerNote                  : 83 79 78 89 32 68 83 67 32 0 0 0 1 0
   
I don't see why it should be blocked, but came up with the following 
possible explanation of what is happening:

The "No scripts" error report seems to come from filetype.rules.conf:

	deny    script          No scripts              No scripts

So I ran "file Group_05221.jpg" and got:

	Group_05221.jpg: JPEG image data, JFIF standard 1.01, resolution 
	(DPI), "ImageDescription           :   ", 72 x 72

Is it possible that MailScanner is picking up "script" in the word 
"ImageDescription" - ie like matching a plain grep pattern instead of a 
grep -w?  If so, can this be fixed?

Thanks for your feedback.

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service