A campus department sent out messages today that (each new one)
kept triggering the
$quarantine_description='Illegal breakage found in header name - potential virus';
part of the qmail-scanner-queue code. I'm running stock v1.16
here with bad_mime = 1. If I look at the perl code and what's dropped
in the quarantine directory, I can't figure out what it was seeing
that was bad. Here's a head and tail of one of the files.
I looked at the file there with a dump program, and the file
as retained there doesn't have anything odd I can see. (newlines for
example are there). As it was, I turned off bad_mime to keep remaining
incoming message from the same fate. I'd like to understand why
this happened. Can anyone see why?
-John
head -n 17 mail.sociology.ohio-state.edu105717792242820908 Received: from mail-mta6.service.ohio-state.edu (128.146.216.46) by mail.sociology.ohio-state.edu with SMTP; 2 Jul 2003 20:32:02 -0000 Received: from localhost.localdomain ([140.254.49.75]) by mail-mta6.service.ohio-state.edu (iPlanet Messaging Server 5.2 HotFix 1.14 (built Mar 18 2003)) with ESMTP id <[EMAIL PROTECTED]> for [EMAIL PROTECTED] (ORCPT [EMAIL PROTECTED]); Wed, 02 Jul 2003 16:32:01 -0400 (EDT) Date: Wed, 02 Jul 2003 16:32:01 -0400 (EDT) Date-warning: Date header was inserted by mail-mta6.service.ohio-state.edu From: [EMAIL PROTECTED] Subject: 03-04 Parking Permit Renewal Message-id: <[EMAIL PROTECTED]> Content-type: text/PLAIN X-Qmail-Scanner-1.16: added fake MIME-Version header MIME-Version: 1.0
tail of same file...
*** Qmail-Scanner Quarantine Envelope Details Begin ***
X-Qmail-Scanner-Mail-From: "[EMAIL PROTECTED]" via mail.sociology.ohio-state.edu
X-Qmail-Scanner-Rcpt-To: "a-user address was here"
X-Qmail-Scanner: 1.16 (uvscan: v4.2.40/v4275. problem Found. Processed in 0.029337 secs)
Quarantine-Description: Illegal breakage found in header name - potential virus
*** Qmail-Scanner Envelope Details End ***
partial "od -a" output 0000000 R e c e i v e d : sp f r o m sp m 0000020 a i l - m t a 6 . s e r v i c e 0000040 . o h i o - s t a t e . e d u sp 0000060 ( 1 2 8 . 1 4 6 . 2 1 6 . 4 6 ) 0000100 nl sp sp b y sp m a i l . s o c i o 0000120 l o g y . o h i o - s t a t e . 0000140 e d u sp w i t h sp S M T P ; sp 2 0000160 sp J u l sp 2 0 0 3 sp 2 0 : 3 2 : 0000200 0 2 sp - 0 0 0 0 nl R e c e i v e 0000220 d : sp f r o m sp l o c a l h o s 0000240 t . l o c a l d o m a i n sp ( [ 0000260 1 4 0 . 2 5 4 . 4 9 . 7 5 ] ) nl 0000300 sp b y sp m a i l - m t a 6 . s e
------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01 _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
