Michel,
If the header + body + the first attachment is larger than
MaxBytes/ClamAVBytes a second (or more) attachment will not be detected!
Just look in to the file ./notspam/9460.eml - is there any other
attachment than the winmail.dat to see? I think it's not. Only the parts
that are written to the .eml files are scanned by ASSP!
But if there is the second attachment (test.xxx) in the 9460.eml file,
please send it to me!
Thomas
"Michel" <[EMAIL PROTECTED]>
Gesendet von: [EMAIL PROTECTED]
07.08.2008 18:24
Bitte antworten an
ASSP development mailing list <[email protected]>
An
"'ASSP development mailing list'" <[email protected]>
Kopie
Thema
Re: [Assp-test] Antwort: Re: Antwort: Re: ASSP 1.4.1 going to be closed
Thomas,
.dat is allowed, .xxx is not.
I tried to send the same message (with the attached, not allowed
'test.xxx') twice via an external account to an inbound account:
first in HTML :
Aug-7-08 18:02:06 Connected: 212.227.126.188:50430 -> xx.xx.xx:25 ->
127.0.0.1:24
Aug-7-08 18:02:06 [EMAIL PROTECTED] matches [EMAIL PROTECTED] in
LocalAddresses_Flat
Aug-7-08 18:02:06 id-24926-09460 212.227.126.188 <[EMAIL PROTECTED]> to:
[EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Aug-7-08 18:02:11
id-24926-09460
212.227.126.188 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] info: attachment
'winmail.dat' found for Level-4
Aug-7-08 18:02:11 id-24926-09460 212.227.126.188 <[EMAIL PROTECTED]> to:
[EMAIL PROTECTED] ClamAV: scanned 321123 bytes in whitelisted message - OK
Aug-7-08 18:02:11 id-24926-09460 [Whitelisted] 212.227.126.188 <
[EMAIL PROTECTED]> to: [EMAIL PROTECTED] whitelisted (no bad attachments)
[Test
HTML] -> ./notspam/9460.eml
Aug-7-08 18:02:11 Disconnected: 212.227.126.188
second in plain text (obviously without 'winmail.dat'):
Aug-7-08 18:02:22 Connected: 212.227.126.187:60972 -> xx.xx.xx:25 ->
127.0.0.1:24
Aug-7-08 18:02:22 [EMAIL PROTECTED] matches [EMAIL PROTECTED] in
LocalAddresses_Flat
Aug-7-08 18:02:22 id-24942-08600 212.227.126.187 <[EMAIL PROTECTED]> to:
[EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED]
Aug-7-08 18:02:22 id-24942-08600 212.227.126.187 <[EMAIL PROTECTED]> to:
[EMAIL PROTECTED] info: attachment 'test.xxx' found for Level-4
Aug-7-08 18:02:22 id-24942-08600 [Attachment] 212.227.126.187
<[EMAIL PROTECTED]> to: [EMAIL PROTECTED] [spam found] (bad attachment
'test.xxx')
Aug-7-08 18:02:22 id-24942-08600 212.227.126.187 <[EMAIL PROTECTED]> to:
[EMAIL PROTECTED] [SMTP Error] 554 test.xxx These attachments are not allowed!
Diese(r) Dateianhaenge sind aus Sicherheitsgruenden nicht
zugelassen.
Aug-7-08 18:02:22 Disconnected: 212.227.126.187
Regards
Michel
Von: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Im Auftrag von Thomas
Eckardt/eck
Gesendet: Donnerstag, 7. August 2008 17:40
An: ASSP development mailing list
Betreff: [Assp-test] Antwort: Re: Antwort: Re: ASSP 1.4.1 going to be
closed
>In addition to that I found, HTML-Mails (winmail.dat included) with not
allowed attachments (in this case 'test.xxx') are not blocked.
Are .dat files not allowed in Level 4 ?
Because "info: attachment 'winmail.dat' found for Level-4" shows that the
engine has found it !?
Thomas
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's
challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes
Grand prize is a trip for two to an Open Source event anywhere in the
world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
