[Esd-l] {Filename?} Unexpected behaviour on "double-dotted" attachment filenames

Sanitizer List sanitizer at nyfix.co.uk
Thu Jun 2 05:48:14 PDT 2005


Warning: This message has had one or more attachments removed
Warning: (JavaConsole_1830_01062006.log.zip).
Warning: Please read the "SPC-Attachment-Warning.txt" attachment(s) for more information.


Hello John & List

Some of my users have been surprised to find that recent 'root-forwards' of wanted but Quarantined mail have contained Base 64
encoded content within a "SECURITY WARNING" attachment rather than the expected file attachment. This content is, of course, the
original attached file.

Investigation shows that the sanitizer copes with zip file attachments named in a 'double-dotted' format in this manner.

ie: <file>.log.zip becomes:-

<quote>
SECURITY WARNING!

The mail system has detected that the following
attachment may contain hazardous program code, is
a suspicious file type, or has a suspicious file name.
Do not trust it. Contact your system administrator immediately.

Scanner score: 0 (poisoned by name, scan skipped)

Content-Type: application/octet-stream; name="JavaConsole_1830_01062006.log.zip"
Content-Disposition: attachment; filename="JavaConsole_1830_01062006.log.zip"
Content-Transfer-Encoding: base64

UEswMFBLAwQUAAAACADTWcIyRgWeLx2GAAA+OwwAIQAAAEphdmFDb25zb2xlXzE4MzBfMDEwNjIw
MDYubG9nLnR4dO29aXPbSJYu/PlWRP0HdETFLbljKgv7Fj1zX1miXOqWJbUoT1WNr8JBk7DMKYrU
......
<unquote>

Is this by design or have I misconfigured?  Can I configure to have such attachments ""properly"" processed?

(Correspondents have been requested to remit in 'single-dotted' form as a workaround)

MTIA for tips.

-Dave


More information about the esd-l mailing list