MailScanner: No programs allowed on MS word XP/2003

[Robert Lopez]

On Mon, Oct 19, 2009 at 6:39 AM,  <Amelein at dantumadiel.eu> wrote:
> I am getting the occasional blocked Word document which MS marks as being an
> executable.
> When I do file -i on it, it tells me: blah.doc: application/msword;
> charset=binary
> In the maillog it tells me Filetype Checks: No executables
>
> It does not do it on every .doc file but I cant seem to figure out what
> is causing it to mark the occasional .doc as executable.
>
> The setup is a Fedora 11 machine with MS 4.78.17
> the filetype.rules.conf containst the following:
> deny    executable      No executables          No programs allowed
> deny    ELF             No executables          No programs allowed
>
> Any idea's where to look for this ?
>
> -
> Arjan
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>

I have found some persons rename executables as .doc trying to sneak
them through the email gateways.
I have verified this by running the unix file command on the quarantined files.
I spoke to some of the senders, including instructors, and apparently
this renaming used to "work" at this college pre MailScanner.

-- 
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106