[Declude.Virus] Sort of OT: Blank Folding Vulnerability in Backup Exec 9.1 Notifications

[Dan Geiser]

Hello, All, We have a customer who is running Veritas Backup Exec.  When their backup runs a notification is triggered by Backup Exec and we bounce that notification through our IMail server and then on to the appropriate parties.  This notification system has been running fine for months now using our IMail server as a relay.   In the past week or so IMail has had trouble routing these messages.  Here is an example message...   - Date:     Fri,  2 Apr 2004 09:27:16 -0500 Message-Id: <[EMAIL PROTECTED]> From:     "Postmaster" <[EMAIL PROTECTED]> Sender:   <[EMAIL PROTECTED]> To:       <[EMAIL PROTECTED]> Subject:  Undeliverable Mail X-Mailer: <SMTP32 v20010131> X-UIDL: 354778710 Status: U   undeliverable to [EMAIL PROTECTED]   Original message follows.   Received: from jacob_file01 [66.166.116.226] by maildesk.net   (SMTPD32-6.06) id A4723E800F6; Fri, 02 Apr 2004 09:10:58 -0500 From: <[EMAIL PROTECTED]> To:  < [EMAIL PROTECTED]> Date: Fri, 02 Apr 2004 09:10:58 -0400 Subject: Backup Exec Alert: Job Success X-Mailer: VERITAS SMTP Mail Component MIME-Version: 1.0 Content-Type: multipart/mixed;  boundary=unique-boundary-1 Message-Id: <[EMAIL PROTECTED]> X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000020e]. X-Declude-Sender: [EMAIL PROTECTED] [66.166.116.226] X-Note: Sent from: [EMAIL PROTECTED] ([66.166.116.226]) X-Note: Sent from Reverse DNS:  h-66-166-116-226.sfldmidn.covad.net X-Note: This E-mail was scanned by Declude [1.75] for viruses.   --unique-boundary-1 Content-Type: text/plain; charset=utf-8   (Server: "JACOB_FILE01") (Job: "Weeknight Full Backup") Completed Success fully. --unique-boundary-1 Content-Type: application/octet-stream  name="BEX01319.htm" Content-Transfer-Encoding: Base64 Content-Disposition: attachment;  filename="BEX01319.htm"   //48AEgAVABNAEwAPgANAAoAPABIAEUAQQBEAD4ADQAKADwATQBFAFQAQQAgAGgAdAB0AHAA LQBlAHEAdQBpAHYAPQAiAEMAbwBuAHQAZQBuAHQALQBUAHkAcABlACIAIABjAG8AbgB0AGUA [message truncated] -   For those of you with a trained eye...   1)  Why does Declude flag the original notification message as having the blank folding vulnerability?  I'm OK with that I'm just curious to know why.   2)  Secondly and actually more importantly.  Why is my IMail system unable to deliver the notification to [EMAIL PROTECTED]?  There appears to be a space right before [EMAIL PROTECTED] in the to line of the original notification.  I believe that space is being added by Backup Exec.  Would that cause the message to be undeliverable?    I think this client just upgraded from Backup Exec 9.0 to Backup Exec 9.1 and I'm thinking that maybe Veritas has unintentionally introduced the Blank Folding Vulnerability from one version to the next.   Thanks In Advance, Dan Geiser [EMAIL PROTECTED]