Potential issue with docx format and Clam

[Jeff A. Earickson]

Julian,

I'm forwarding along a note from our support desk people, who seem to
have uncovered an issue with Office 2007/2008 docx file formats and
the ClamAV recursion level.  In my case, I am running MS 4.75.9-2 with

ClamAVmodule Maximum Recursion Level = 8

Adam's detective work below suggests that this setting may be too low
for Office 2007/2008 docx attachments.  Anybody else seen this?

(Time for me to upgrade to the latest stable version, or the latest beta).

Jeff Earickson
Colby College

---------- Forwarded message ----------

I did some experimenting with this situation [rejections of email with 
"Report: MailScanner: Message contained archive nested too deeply" messages]
and here is what I found:

- As you may or may not know the new Office 2007/2008 file format is really
just a renamed .zip file containing other files and folders that make up the
document.

- If you insert an object into a .docx that is, for instance, a PowerPoint
slide it is inserted as a .pptx (again, just a .zip with a different
extension).

- If that slide contains an inserted Excel table, it is inserted as a .xlsx
(.zip).

- So if you add all those up you have the original .docx, which contains a
folder called "embedded", in that folder is a .pptx file, inside that is a
folder called "embedded", in that folder is a .xlsx file, inside that is a
series of files and folders.  So all that added up is 7 layers.

I was able to duplicate Todd's error with my own .docx, .pptx and .xlsx, but
I noticed that it had to be all three.  If I tried to email a .docx with
just a PowerPoint slide embedded it went fine.  And if I tried to email a
.pptx with an embedded Excel Table that went fine too.  So it seems as
though we may need to adjust some settings on MailScanner to allow for this
type of file to pass because as we convert more and more people to Office
2007/2008 we are going to be more likely to run into these types of
situations.

------------
Adam Nielsen
Faculty and Staff Support Center
x4222