Report: Denial of Service attack in message!

Rick Chadderdon mailscanner at yeticomputers.com
Thu Mar 15 17:03:06 CET 2007


Neil Wilson wrote:
> Why are these getting blocked, how can I stop these, and what check in
> MailScanner handles these as I've looked through all of the checks and
> the only thing I can find regarding "Denial of service" is "TNEF
> Expander = /usr/bin/tnef --maxsize=100000000", but this by default is
> set to nearly 100MB if my calculations are right, and these mails are
> no where near this size. 

That denial of service message can be caused by timeouts while virus
scanning the email in question.  Is the server heavily loaded?

Many versions of Microsoft Outlook are configured by default to send
Rich Text messages.  When Outlook does this, it attaches a TNEF file
that contains the formatting info for the message.  I've seen the TNEF
decoder choke on these files from time to time, causing the above
mentioned timeouts.  You might want to try changing to the internal
decoder, or upgrade your version of the external decoder if it's old.

Rick


More information about the MailScanner mailing list