Re: [Declude.Virus] Sort of OT: Blank Folding Vulnerability in Backup Exec 9.1 Notifications

2004-04-06 Thread R. Scott Perry

Sorry about that.  I included the wrong message.  I had 2 issues confused
with each other.  Here is the one I was referring to where Declude blocks
the message...

Headers Follow:
Received: from bhfserver [68.74.44.200] by NexusTechGroup.com
  (SMTPD32-6.06) id A864C60136; Fri, 02 Apr 2004 01:29:56 -0500
From: [EMAIL PROTECTED]
To:   [EMAIL PROTECTED]
Date: Fri, 02 Apr 2004 01:29:56 -0400
Subject: Backup Exec Alert: Job Failed (Server: BHFSERVER) (Job: Backup
0001)
X-Mailer: VERITAS SMTP Mail Component
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Message-Id: [EMAIL PROTECTED]
The problem here is the blank line after the Subject: header.  That line 
presumably originally contained a single space or tab character, which 
introduces the Blank Folding vulnerability (which violates RFC2822).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] Sort of OT: Blank Folding Vulnerability in Backup Exec 9.1 Notifications

2004-04-06 Thread Dan Geiser
Hi, Scott,
Sorry about that.  I included the wrong message.  I had 2 issues confused
with each other.  Here is the one I was referring to where Declude blocks
the message...

---
-Original Message- 
From: Postmaster
Sent: Fri 4/2/2004 1:29 AM
To: [EMAIL PROTECTED]
Cc:
Subject: WARNING: YOU WERE SENT A VIRUS


The virus scanner software at Nexus Technology Group on NexusTechGroup.com
has reported someone sent you an E-mail from [EMAIL PROTECTED],
containing the [Outlook 'Blank Folding' Vulnerability] virus in the [No
attachment] attachment.  The subject of the E-mail was Backup Exec Alert:
Job Failed (Server: BHFSERVER) (Job: Backup 0001) .

The E-mail containing the virus has been deleted to prevent any damage.

Headers Follow:
Received: from bhfserver [68.74.44.200] by NexusTechGroup.com
  (SMTPD32-6.06) id A864C60136; Fri, 02 Apr 2004 01:29:56 -0500
From: [EMAIL PROTECTED]
To:   [EMAIL PROTECTED]
Date: Fri, 02 Apr 2004 01:29:56 -0400
Subject: Backup Exec Alert: Job Failed (Server: BHFSERVER) (Job: Backup
0001)

X-Mailer: VERITAS SMTP Mail Component
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Message-Id: [EMAIL PROTECTED]

---

Any ideas?

Thanks, Again,
Dan Geiser
[EMAIL PROTECTED]

- Original Message - 
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, April 05, 2004 6:54 PM
Subject: Re: [Declude.Virus] Sort of OT: Blank Folding Vulnerability in
Backup Exec 9.1 Notifications



 We have a customer who is running Veritas Backup Exec.  When their backup
 runs a notification is triggered by Backup Exec and we bounce that
 notification through our IMail server and then on to the appropriate
 parties.  This notification system has been running fine for months now
 using our IMail server as a relay.
 
 In the past week or so IMail has had trouble routing these messages.
Here
 is an example message...
 
 -
 From: Postmaster
 mailto:[EMAIL PROTECTED][EMAIL PROTECTED]
 
 undeliverable to mailto:[EMAIL PROTECTED][EMAIL PROTECTED]

 This one indicates that IMail can't deliver the E-mail to
 mailto:[EMAIL PROTECTED][EMAIL PROTECTED]  However:

 Original message follows.
 
 Subject: Backup Exec Alert: Job Success
 ...

 There is no indication that Declude blocked this E-mail.

 For those of you with a trained eye...
 
 1)  Why does Declude flag the original notification message as having the
 blank folding vulnerability?  I'm OK with that I'm just curious to know
why.

 I don't see any indication that it did.

 2)  Secondly and actually more importantly.  Why is my IMail system
unable
 to deliver the notification to
 mailto:[EMAIL PROTECTED][EMAIL PROTECTED]  There appears to be a space
 right before mailto:[EMAIL PROTECTED][EMAIL PROTECTED] in the to line of
the
 original notification.  I believe that space is being added by Backup
 Exec.  Would that cause the message to be undeliverable?

 That would likely cause the message to be undeliverable.

 -Scott
 ---
 Declude JunkMail: The advanced anti-spam solution for IMail mailservers
 since 2000.
 Declude Virus: Ultra reliable virus detection and the leader in mailserver
 vulnerability detection.
 Find out what you've been missing: Ask for a free 30-day evaluation.

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.Virus mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.Virus.The archives can be found
 at http://www.mail-archive.com.
 ---
 Sign up for virus-free and spam-free e-mail with Nexus Technology Group
 http://www.nexustechgroup.com/mailscan



---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] Sort of OT: Blank Folding Vulnerability in Backup Exec 9.1 Notifications

2004-04-05 Thread R. Scott Perry

We have a customer who is running Veritas Backup Exec.  When their backup 
runs a notification is triggered by Backup Exec and we bounce that 
notification through our IMail server and then on to the appropriate 
parties.  This notification system has been running fine for months now 
using our IMail server as a relay.

In the past week or so IMail has had trouble routing these messages.  Here 
is an example message...

-
From: Postmaster 
mailto:[EMAIL PROTECTED][EMAIL PROTECTED]

undeliverable to mailto:[EMAIL PROTECTED][EMAIL PROTECTED]
This one indicates that IMail can't deliver the E-mail to 
mailto:[EMAIL PROTECTED][EMAIL PROTECTED]  However:

Original message follows.

Subject: Backup Exec Alert: Job Success
...

There is no indication that Declude blocked this E-mail.

For those of you with a trained eye...

1)  Why does Declude flag the original notification message as having the 
blank folding vulnerability?  I'm OK with that I'm just curious to know why.
I don't see any indication that it did.

2)  Secondly and actually more importantly.  Why is my IMail system unable 
to deliver the notification to 
mailto:[EMAIL PROTECTED][EMAIL PROTECTED]  There appears to be a space 
right before mailto:[EMAIL PROTECTED][EMAIL PROTECTED] in the to line of the 
original notification.  I believe that space is being added by Backup 
Exec.  Would that cause the message to be undeliverable?
That would likely cause the message to be undeliverable.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.