Messages Outlook/Exchange can't delete

[Kris Shaw]

Hello,

I suspect that the already invalid message header (reply address perhaps) is 
being further mangled to the point that it upsets Exchange. Outlook 2003 is 
unable to open the spam message attached via MailScanner, although Outlook 
Express can when connecting via IMAP.

I probably should have included a bit more information about what versions I 
am running.

We are running Sendmail  8.13.7 and MailScanner version 4.55.9

Module versions are:
1.00    AnyDBM_File
1.14    Archive::Zip
1.02    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.72    File::Basename
2.07    File::Copy
2.01    FileHandle
1.06    File::Path
0.16    File::Temp
0.90    Filesys::Df
1.35    HTML::Entities
3.54    HTML::Parser
2.37    HTML::TokeParser
1.21    IO
1.10    IO::File
1.123   IO::Pipe
1.71    Mail::Header
3.05    MIME::Base64
5.420   MIME::Decoder
5.420   MIME::Decoder::UU
5.420   MIME::Head
5.420   MIME::Parser
3.03    MIME::QuotedPrint
5.420   MIME::Tools
0.10    Net::CIDR
1.08    POSIX
1.77    Socket
1.4     Sys::Hostname::Long
0.17    Sys::Syslog
1.86    Time::HiRes
1.02    Time::localtime


----- Original Message ----- 
From: "Glenn Steen" <glenn.steen at gmail.com>
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Sent: Tuesday, September 19, 2006 4:44 PM
Subject: Re: Messages Outlook/Exchange can't delete


> On 19/09/06, Kris Shaw <mailscanner at wealdclose.co.uk> wrote:
>>
>>
>> Hello,
>>
>> We run Exchange 2003 SP2 with MailScanner in front of it.
>>
>> We have recently been sent some spam messages that we initially were 
>> unable
>> to delete via Outlook (2000 or 2003), OWA and IMAP.
>>
>> After an investigation it transpired that in fact the messages could in 
>> fact
>> be deleted (shift-delete in Outlook) although they couldn't be moved 
>> (into
>> other folders, such as 'Deleted Items'). Attempting to move the messages 
>> via
>> IMAP resulted in "An error occurred calling into the Microsoft Exchange
>> Information Store service: the call to EcMoveCopyMessages failed with 
>> error
>> 0x8004011b." from the Information Store.
>>
>> The subject lines are similar to:
>> "Tuesday.CRSVF.puts him in a "
>>
>> Our spam.actions.rules file default action is:
>> FromOrTo:       default         deliver attachment header "X-Spam-Status:
>> Yes"
>>
>> The sender address looked malformed in the MailScanner produced email 
>> that
>> wraps the spam message:
>> From: "\"George Roman\"
>> <tkuhn at rvapc.com>{SET":tkuhn at rvapc.com
>>
>> The attached spam email has the following address, which although invalid
>> looks different to the MailScanner produced version:
>> From: "George Roman" <tkuhn at rvapc.com>{SET:debug=11}
>>
>> Has anyone seen this?
>>
>> Regards,
>>
>> Kris.
>>
> What MTA is MailScanner running with? I for one has never seen this,
> mainly (I suspect) because I reject a lot of bogous cr*p right up
> front in postfix (RFC strictness... Simply reject
> malformed/non-correct envelope addresses, HELO strings etc). I'm sure
> you can do pretty much the same with any MTA (well... perhaps not
> exchange:-).
> Makes life easier;)
> -- 
> -- Glenn
> email: glenn < dot > steen < at > gmail < dot > com
> work: glenn < dot > steen < at > ap1 < dot > se
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!