MailScanner fix for Exchange TNEF vuln?

Ghetti, Ron Ron.Ghetti at town.barnstable.ma.us
Fri Feb 13 20:02:34 GMT 2009


-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Cedric Devillers
Sent: Friday, February 13, 2009 9:50 AM
To: MailScanner discussion
Subject: Re: MailScanner fix for Exchange TNEF vuln?


Well, i can't tell you if it's related to some outlook/exchange version
or config, but here that's easily reproductible here.

Without TNEF (winmail.dat thing), outlook receive meeting requests as
plain mail messages. You don't see the fancy buttons (accept, decline,
etc) and users complain of other missing features (can't remember
exactly which one). With TNEF replacement disabled, everything is
automagically working again.

TNEF is used by outlook for special features, that's why it's also a
dangerous thing.

Jonas Akrouh Larsen wrote:
>> I'm not sure that's entirely acurate.  I have replace TNEF enabled, but
> have received meeting requests from 3rd parties outside our system.  I've
> never had any complaints...
> 
> Same here. We have replaced TNEF for over a year, and have never had issues
> with outlook meeting requests or calendar bookings.
> 
> And all our clients user outlook/exchange.
> 


Same Here, All our users run Outlook.
I checked my settings and the TNEF replacement is enabled, I'm not
Sure if that was the default or not.
We do occasionally have a meeting not received complaint.
But it's not a regular thing and I haven't persued it. Instead, we've typically told them that 
internet email "doesn't work well" with microsoft outlook calendar.
Usually if they retry sending the meeting later, they will go through ok.

Why am I not surprised someone has hacked a microsoft product...

-Ron

> 
> 
> Med venlig hilsen / Best regards
>  
> Jonas Akrouh Larsen
>  
> TechBiz ApS
> Laplandsgade 4, 2. sal
> 2300 København S
>  
> Office: 7020 0979
> Direct: 3336 9974
> Mobile: 5120 1096
> Fax:    7020 0978
> Web: www.techbiz.dk
> 
> 
> 
> 


--
Visitez notre nouveau site web: www.amstergroup.com

-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 


More information about the MailScanner mailing list