Problem with blocked jpg file

[Julian Field]

Jim Holland wrote:
> Hi Julian
>
> I think this is in your department.
>
> I was puzzled by a message whose jpg attachment was blocked with error:
>
> 	MailScanner: No scripts (Group_05221.jpg)
>
> The file is just a jpg, and clamscan can't see anything wrong with it.  It 
> doesn't seem to contain any script, although it has the following header:
>
> .....JFIF...HH...ZImageDescription           :
> Make                       : SONY
> Model                      : CYBERSHOT
> ExposureTime               : 0.025000
> FNumber                    : 2.800000
> ExposureProgram            : 2
> ISOSpeedRatings            : 160
> CompressedBitsPerPixel     : 2.000000
> ExposureBiasValue          : 0.000000
> MaxApertureValue           : 3.000000
> MeteringMode               : 2
> LightSource                : 0
> Flash                      : 1
> FocalLength                : 8.000000
> MakerNote                  : 83 79 78 89 32 68 83 67 32 0 0 0 1 0
>    
> I don't see why it should be blocked, but came up with the following 
> possible explanation of what is happening:
>
> The "No scripts" error report seems to come from filetype.rules.conf:
>
> 	deny    script          No scripts              No scripts
>
> So I ran "file Group_05221.jpg" and got:
>
> 	Group_05221.jpg: JPEG image data, JFIF standard 1.01, resolution 
> 	(DPI), "ImageDescription           :   ", 72 x 72
>
> Is it possible that MailScanner is picking up "script" in the word 
> "ImageDescription" - ie like matching a plain grep pattern instead of a 
> grep -w?  If so, can this be fixed?
Good catch. Easy to fix. Just change
    script
to
    \sscript
I have put this change into the next release.

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.