Bad filename detected

[Glenn Steen]

On 19/09/2007, Alexandros G. Fragkiadakis <alfrag at econ.soc.uoc.gr> wrote:
> Gareth wrote:
> > I am guessing that the attachment contains foreign text?
> > The problem is caused by the 'file' command thinking it is an executable
> > file. Executables dont have a common header so some foreight words at
> > the start of the file can cause this problem.
> > Yoy can remove the offending entries from the /usr/share/file/magic
> > file. Search through the archives for more information on this.
> >
> > On Wed, 2007-09-19 at 09:24, Alexandros G. Fragkiadakis wrote:
> >
> >> Hi all,
> >>
> >> Mailscanner gives me the following warnings:
> >>
> >> The following e-mails were found to have: Bad Filename Detected
> >>
> >> Sender: xxxxxx at xxx.xxx.xxx.xx
> >> </econ/src/compose.php?send_to=>
> >> IP Address: xxx.xxx.xxx.xxx
> >> Recipient: xxxx at xx.xx </econ/src/compose.php?send_to=>
> >> Subject: Re: xxx
> >> MessageID: 9691B2BB95.039CD
> >> Quarantine: /var/spool/MailScanner/quarantine/20070919/9691B2BB95.039CD
> >> Report: MailScanner: No programs allowed (msg-5333-73.txt)
> >>
> >>
> >> The user didn't send any attachments. I cannot understand why
> >> mailscanner has problem with this email.
> >>
> >> Any help?
> >>
> >> Regards,
> >>
> >> Alexandros
> >>
> >>
> >>
>
> The user sends no attachments at all!
>
The "offending attachment" is likely the mails body text. if you look
at the actual quarantined entry (in the filesystem), you can run the
file command on the reported file ... just do:
cd /var/spool/MailScanner/quarantine/20070919/9691B2BB95.039CD
file msg-5333-73.txt
... and you'll see what the file command thinks about it. Likely it'll
deem it something like "COM Executable (MS-DOS)", which is an
over-optimistic one byte magic in some versions of file.
Solutions? Hack you magic file, as already suggested (you need
"compiler it" with "file -C" or somesuch ... look in the archives for
the list.... all details are there:-), or update your file command to
a version that isn't broken this particular way... or just disable the
filetype checking (I wouldn't do that, it is effective...:-) by
clearing out the File Command setting in
/etc/MailScanner/MailScanner.conf ... Your choice where you go, what
you do;).

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se