Bad filename detected

[Glenn Steen]

On 19/09/2007, Scott Silva <ssilva at sgvwater.com> wrote:
> Glenn Steen spake the following on 9/19/2007 2:45 AM:
> > On 19/09/2007, Alexandros G. Fragkiadakis <alfrag at econ.soc.uoc.gr> wrote:
> >> Gareth wrote:
> >>> I am guessing that the attachment contains foreign text?
> >>> The problem is caused by the 'file' command thinking it is an executable
> >>> file. Executables dont have a common header so some foreight words at
> >>> the start of the file can cause this problem.
> >>> Yoy can remove the offending entries from the /usr/share/file/magic
> >>> file. Search through the archives for more information on this.
> >>>
> >>> On Wed, 2007-09-19 at 09:24, Alexandros G. Fragkiadakis wrote:
> >>>
> >>>> Hi all,
> >>>>
> >>>> Mailscanner gives me the following warnings:
> >>>>
> >>>> The following e-mails were found to have: Bad Filename Detected
> >>>>
> >>>> Sender: xxxxxx at xxx.xxx.xxx.xx
> >>>> </econ/src/compose.php?send_to=>
> >>>> IP Address: xxx.xxx.xxx.xxx
> >>>> Recipient: xxxx at xx.xx </econ/src/compose.php?send_to=>
> >>>> Subject: Re: xxx
> >>>> MessageID: 9691B2BB95.039CD
> >>>> Quarantine: /var/spool/MailScanner/quarantine/20070919/9691B2BB95.039CD
> >>>> Report: MailScanner: No programs allowed (msg-5333-73.txt)
> >>>>
> >>>>
> >>>> The user didn't send any attachments. I cannot understand why
> >>>> mailscanner has problem with this email.
> >>>>
> >>>> Any help?
> >>>>
> >>>> Regards,
> >>>>
> >>>> Alexandros
> >>>>
> >>>>
> >>>>
> >> The user sends no attachments at all!
> >>
> > The "offending attachment" is likely the mails body text. if you look
> > at the actual quarantined entry (in the filesystem), you can run the
> > file command on the reported file ... just do:
> > cd /var/spool/MailScanner/quarantine/20070919/9691B2BB95.039CD
> > file msg-5333-73.txt
> > ... and you'll see what the file command thinks about it. Likely it'll
> > deem it something like "COM Executable (MS-DOS)", which is an
> > over-optimistic one byte magic in some versions of file.
> > Solutions? Hack you magic file, as already suggested (you need
> > "compiler it" with "file -C" or somesuch ... look in the archives for
> > the list.... all details are there:-), or update your file command to
> > a version that isn't broken this particular way... or just disable the
> > filetype checking (I wouldn't do that, it is effective...:-) by
> > clearing out the File Command setting in
> > /etc/MailScanner/MailScanner.conf ... Your choice where you go, what
> > you do;).
> >
> > Cheers
> The string" I'm free tomorrow" will trigger a quicktime file flag. It can be
> that simple.
>
Yeah, sure... It's just that ISTR there being some common greek phrase
that would match one of the idiotic 1-byte magics for COM files... And
Alexandros seems to have a vaguely greek name... and domain ....:-):-)

Cheers buddy
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se