Bad filename detected

[Scott Silva]

Glenn Steen spake the following on 9/19/2007 2:45 AM:
> On 19/09/2007, Alexandros G. Fragkiadakis <alfrag at econ.soc.uoc.gr> wrote:
>> Gareth wrote:
>>> I am guessing that the attachment contains foreign text?
>>> The problem is caused by the 'file' command thinking it is an executable
>>> file. Executables dont have a common header so some foreight words at
>>> the start of the file can cause this problem.
>>> Yoy can remove the offending entries from the /usr/share/file/magic
>>> file. Search through the archives for more information on this.
>>>
>>> On Wed, 2007-09-19 at 09:24, Alexandros G. Fragkiadakis wrote:
>>>
>>>> Hi all,
>>>>
>>>> Mailscanner gives me the following warnings:
>>>>
>>>> The following e-mails were found to have: Bad Filename Detected
>>>>
>>>> Sender: xxxxxx at xxx.xxx.xxx.xx
>>>> </econ/src/compose.php?send_to=>
>>>> IP Address: xxx.xxx.xxx.xxx
>>>> Recipient: xxxx at xx.xx </econ/src/compose.php?send_to=>
>>>> Subject: Re: xxx
>>>> MessageID: 9691B2BB95.039CD
>>>> Quarantine: /var/spool/MailScanner/quarantine/20070919/9691B2BB95.039CD
>>>> Report: MailScanner: No programs allowed (msg-5333-73.txt)
>>>>
>>>>
>>>> The user didn't send any attachments. I cannot understand why
>>>> mailscanner has problem with this email.
>>>>
>>>> Any help?
>>>>
>>>> Regards,
>>>>
>>>> Alexandros
>>>>
>>>>
>>>>
>> The user sends no attachments at all!
>>
> The "offending attachment" is likely the mails body text. if you look
> at the actual quarantined entry (in the filesystem), you can run the
> file command on the reported file ... just do:
> cd /var/spool/MailScanner/quarantine/20070919/9691B2BB95.039CD
> file msg-5333-73.txt
> ... and you'll see what the file command thinks about it. Likely it'll
> deem it something like "COM Executable (MS-DOS)", which is an
> over-optimistic one byte magic in some versions of file.
> Solutions? Hack you magic file, as already suggested (you need
> "compiler it" with "file -C" or somesuch ... look in the archives for
> the list.... all details are there:-), or update your file command to
> a version that isn't broken this particular way... or just disable the
> filetype checking (I wouldn't do that, it is effective...:-) by
> clearing out the File Command setting in
> /etc/MailScanner/MailScanner.conf ... Your choice where you go, what
> you do;).
> 
> Cheers
The string" I'm free tomorrow" will trigger a quicktime file flag. It can be 
that simple.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!