Filter Script not detecting all attachments

Discussion forum for Enterprise Edition.
Post Reply
delta2
Posts: 42
Joined: Mon Dec 20, 2004 7:25 am

Filter Script not detecting all attachments

Post by delta2 » Fri Oct 21, 2016 5:24 am

I have a filter script that detects zip attachments:

Code: Select all

If ([ME_HASANATTACHMENT] = 1) Then       
  If CriteriaMet([ME_HASATTACHMENTSMATCHING],"*.zip") then
     ... more criteria ... do stuff ...
  End If
End If
It detects the following:

Code: Select all

--------------020408020601090609020409
Content-Type: application/x-zip-compressed;
 name="delme.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="delme.zip"

UEsDBBQAAAAAAK2BS0mFEUoNCwAAAAsAAAAJAAAAZGVsbWUudHh0aGVsbG8gd29ybGRQSwEC
FAAUAAAAAACtgUtJhRFKDQsAAAALAAAACQAAAAAAAAABACAAAAAAAAAAZGVsbWUudHh0UEsF
BgAAAAABAAEANwAAADIAAAAAAA==
--------------020408020601090609020409--
But not this:

Code: Select all

--=-JZU--Pofbs8iWICwWWs96MJ5fMWi8adBRKlapatxq1INxfH
Content-Type: application/zip; name="delme.zip"
Content-Transfer-Encoding: base64
Content-ID: <005401d22af6$9ef60390$0a00a8c0@7XV8WJT>

UEsDBBUAAAAJAMFCVEkZ5AncZs4BACS+AgAmAAAAMjAxNjEwMjBfNDc4MzkyODgwMV85MjIw
MTkyODMzLnBkZi5leGXkXA18U1cVPy9J07RNaaB1FOi6MAp0rJRSCmSQwWsbShkp7dYCddaZ
AAAAAAEAGACl1PRDmirSAQDaQLGFKtIBANpAsYUq0gFQSwUGAAAAAAEAAQB4AAAAqs4BAAAA

--=-JZU--Pofbs8iWICwWWs96MJ5fMWi8adBRKlapatxq1INxfH--
There are a lot of viruses/trojans arriving in zipped attachments and it's important that they are dealt with.

Any suggestions ? Thanks. Stuart
Stuart

delta2
Posts: 42
Joined: Mon Dec 20, 2004 7:25 am

Re: Filter Script not detecting all attachments

Post by delta2 » Mon Oct 24, 2016 4:03 pm

The following is picked up as an attachment but not as a ZIP

CriteriaMet([ME_HASATTACHMENTSMATCHING],"*.zip")


----boundary_700_69315873-e29c-656b-756b-cf869645dcf8
Content-Type: application/x-compressed; name= Receipt 492-46611.zip
Content-Transfer-Encoding: base64
Content-Disposition: attachment

UEsDBBQACAAIAKGDWEkAAAAAAAAAAAAAAAAXAAAAUmVjZWlwdCA0MDI3OC0zMTYwMS53c2bt
XWtz2kiX/uypmv+gobbGMLaJxCWOx/G8y0VgcARGXGxIuVJCkkEgEJGEuczkv2/fWxISdrLv
ABcAAAAAAAAAAAAAAAAAAAAAAFJlY2VpcHQgNDAyNzgtMzE2MDEud3NmUEsFBgAAAAABAAEA
RQAAAOceAAAAAA==

----boundary_700_69315873-e29c-656b-756b-cf869645dcf8--
Stuart

MailEnable-Ian
Site Admin
Posts: 9101
Joined: Mon Mar 22, 2004 4:44 am
Location: Melbourne, Victoria, Australia

Re: Filter Script not detecting all attachments

Post by MailEnable-Ian » Wed Oct 26, 2016 10:56 pm

Hi Stuart,

I have raised an issue in our register to be reviewed the developers. Will let you know more information when I have it hand. Alternatively lodge a support ticket for a managed response.
Regards,

Ian Margarone
MailEnable Support

delta2
Posts: 42
Joined: Mon Dec 20, 2004 7:25 am

Re: Filter Script not detecting all attachments

Post by delta2 » Wed Nov 23, 2016 11:05 am

The following is not recognised as having a zip attachment:

Code: Select all

--49A8417B6E55B2465
Content-Type: application/zip; name="Allegato_01.Tif Allegato_02.Tif.zip"
Content-Transfer-Encoding: base64
Content-ID: <005301d245c3$2371de50$020ba8c0@Y2KGTOZE>

UEsDBBQAAAAIACFRd0n3ea6yB9wBACf6AgA8AAAARElDSElBUkFaSU9ORSBQRVIgQ09OVEVO ...
I'm getting malware passing my antispam filters !
Stuart

Post Reply