MS Office 2007 File Problems

[Rick Cooper]

----Original Message----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Andrew
Bruce Sent: Wednesday, June 10, 2009 8:12 PM To: MailScanner discussion
Subject: Re: MS Office 2007 File Problems

> Are rules not processed in order?
> 
> Surely an allow line higher in the list would be matched first and the
> attachment allowed through, before the deny rule stops them?
> 
> AB
> 
> On Wed, 10 Jun 2009 18:27:51 -0500, Alex Neuman  wrote:
> 
> Because you have the "double file extension" rule set, and files inside
> the compress office docx files have dotsomethingdotsomethinelsedotblah in
> them.
> On Wed, Jun 10, 2009 at 4:15 PM, Andrew Bruce  wrote:
> Hi,
> 
> I'm having some trouble with Office 2007 files not being allowed through
> MailScanner.
> 
> I've got these (applicable) rules in my filename.rules.conf:
> 
> # docx
> allow .docx$ - -
> allow .xml[0-9].rel$ - -

Change to:

allow   \.x(ml)?\d{0,}\.rel$

Depending on the number and type of .rel files the names get pretty tricky.
I suppose the format is documented somewhere but painful experience brought
me to the above expression




> 
> # Allow repeated file extension, e.g. blah.zip.zip
> allow (.[a-z0-9]{3})1$ - -
> 
> # Deny all other double file extensions. This catches any hidden
> filenames.
> deny .[a-z][a-z0-9]{2,3}s*.[a-z0-9]{3}$ Found possible filename hiding
> Attempt to hide real filename extension
> 
> Yet am still seeing results like this:
> Report: MailScanner: Attempt to hide real filename extension
> (document.xml.rel)
> MailScanner: Attempt to hide real filename extension (settings.xml.rel)
> Report: MailScanner: Attempt to hide real filename extension
> (document.xml1.rel)
> MailScanner: Attempt to hide real filename extension (settings.xml1.rel)
> Report: MailScanner: Attempt to hide real filename extension
> (document.xml1.rel)
> Report: MailScanner: Attempt to hide real filename extension
> (document.xml.rel)
> Report: MailScanner: Attempt to hide real filename extension
> (settings.xml.rel)
> Report: MailScanner: Attempt to hide real filename extension
> (settings.xml1.rel)
> 
> I'm running MailScanner version 4.61.7 (yes, I will be upgrading this
> when
> I can afford the server downtime).
> 
> Any idea why this would be?
> 
> Thanks,
> 
> Andrew
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info [2]
> http://lists.mailscanner.info/mailman/listinfo/mailscanner [3]
> 
> Before posting, read http://wiki.mailscanner.info/posting [4]
> 
> Support MailScanner development - buy the book off the website!
> 
> --
> Alex Neuman van der Hans
> Reliant Technologies
> +507 6781-9505
> +507 202-1525
> alex at rtpty.com [5]
> Skype: alexneuman
> 
> 
> 
> Links:
> ------
> [1] mailto:abruce at hope-st.ath.cx
> [2] mailto:mailscanner at lists.mailscanner.info
> [3] http://lists.mailscanner.info/mailman/listinfo/mailscanner
> [4] http://wiki.mailscanner.info/posting
> [5] mailto:alex at rtpty.com
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.