Attachments not being recognized by mailscanner

A&M ImpacT [W. Kranenborg] w.kranenborg at am-impact.nl
Tue Oct 9 09:36:43 IST 2007


The option "Find UU-Encoded Files" is added in mailscanner 4.50 and we
user 4.46.2(http://packages.ubuntu.com/dapper/mail/mailscanner is the
version we use) see the changelog:
http://lists.mailscanner.info/pipermail/mailscanner-announce/2006-Februa
ry/000003.html

 - - Added UU-decoder to automatically extract files from attachments  
that were
   stored in uu-encoded form. This behaves similarly to the zip and rar
   decoders. The virus scanners should check inside these files for  
themselves
   anyway, but this assists them when they do not. It also allows for  
filename
   and filetype checking of files stored in uu-encoded attachments.
- - Added configuration option "Find UU-Encoded Files" to set whether  
uu-encoded
   files are decoded or not. These files are very rarely used, and the
   overhead of finding them is fairly large as it involves reading all
   existing attachments looking for the signature of them. So the  
default is
   to not look for them. A ruleset can be used to protect particularly
   vulnerable recipients or senders.

Is there any other solution or do we have to upgrade?

Kind regards,
Wessel Kranenborg

> -----Oorspronkelijk bericht-----
> Van: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] Namens Julian Field
> Verzonden: dinsdag 9 oktober 2007 10:20
> Aan: MailScanner discussion
> Onderwerp: Re: Attachments not being recognized by mailscanner
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Set
> Find UU-Encoded Files = yes
> in MailScanner.conf.
> 
> A&M ImpacT [W. Kranenborg] wrote:
> > Dear mailscanner users,
> >
> > We have a 64-bit server with mailscanner 4.46.2, spamassassin 3.1.3
and
> > sendmail 8.13.5.
> >
> > We have a problem with this set-up and we don't know the reason. The
> > problem is that mailscanner doesn't recognize some attachments so
the
> > binary code of the attachments is shown in the body of the message.
> > Spamassassin detects a lot of strange characters and gives it a very
> > high score so the message is marked as spam.
> > An example message:
> >
> > -------------------------------------
> >
> > Here is the body of the message with nothing strange in it.
> >
> > begin 666 pakbon haven Ningbo.JPG
> > M_]C_X `02D9)1@`!`0$!+ $L``#_X0?P17AI9@``24DJ``@````'`!(!`P`!
> > M`````0```!H!!0`!````8@```!L!!0`!````:@```"@!`P`!`````@```#$!
> > M`@`4````<@```#(!`@`4````A@```&F'! `!````F@```,0````L`0```0``
> > M`"P!```!````061O8F4 at 4&AO=&]S:&]P(#<N, `R,# W.C$P.C Q(#$X.C$R
> > M.C(X``,``: #``$```#__P```J $``$````@`P```Z $``$```!+`@``````
> > M``8``P$#``$````&````&@$%``$````2`0``&P$%``$````:`0``* $#``$`
> > M```"`````0($``$````B`0```@($``$```#&!@```````$@````!````2 ``
> > M``$```#_V/_@`!!*1DE&``$"`0!(`$@``/_M``Q!9&]B95]#30`"_^X`#D%D
> > M;V)E`&2 `````?_;`(0`# @(" D(# D)#!$+"@L1%0\,# \5&!,3%1,3&!$,
> > M# P,# P1# P,# P,# P,# P,# P,# P,# P,# P,# P,# $-"PL-#@T0#@X0
> >
> > This goes on a bit until we get this:
> >
> > M6***`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`H
> > MHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BB
> > MB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****`"BBB@`HHHH`****
> > M`"BBB@`IJEB6RN #A3D'<,#YN.G/:G44`%%%% !1110`4444`%%%% !1110`
> > I4444`%%%4M2ED at T^]FB8I+%:SR1N,':Z1LRL`05." <$$'H010!__]D`
> > `
> > end
> >
> > -------------------------------------
> >
> > Does anyone have any solutions for this very strange problem because
> > when I send this message to my own email-adres the client recognizes
the
> > .JPG and shows it as an attachment but mailscanner doesn't.
> >
> > Hope to hear from you soon.
> >
> > Kind regards,
> > Wessel Kranenborg
> >
> >
> 
> Jules
> 
> - --
> Julian Field MEng CITP
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> 
> Need help customising MailScanner?
> Contact me!
> Need help fixing or optimising your systems?
> Contact me!
> Need help getting you started solving new requirements from your boss?
> Contact me!
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.6.3 (Build 3017)
> Comment: (pgp-secured)
> Charset: ISO-8859-1
> 
> wj8DBQFHCzmeEfZZRxQVtlQRArRUAJ40l6CcydEKOtYmev2haPAQW5Eh1wCfUW6o
> hbZyUe8ItP9xJAa3CPs33V0=
> =FOi8
> -----END PGP SIGNATURE-----
> 
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> For all your IT requirements visit www.transtec.co.uk
> 
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!


More information about the MailScanner mailing list