Markus Stumpf writes:
I am using reformime with qmail and my own qmail-queue replacement
for use with a virus scanner (sophos).
Recently I had a virus come through. A close look revealed that
the header of the message was faulty, it looked like:
------------------------------------------------------------------------
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="bound"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.
------------------------------------------------------------------------
(look at the indented ie. continuation lines starting with "X-")
Due to this faulty header reformime failed to decompose the message
into the sections. I got no section at all.
It reported:
------------------------------------------------------------------------
section: 1
content-type: multipart/mixed
content-name:
content-transfer-encoding: 8bit
charset: iso-8859-1
line-count: 169
body-line-count: 127
------------------------------------------------------------------------
and that was it. No files where created (reformime -i -xSCAN_ < INPUT)
the virus scanner had nothing to scan and (my fault, programming flaw)
the message went through. I have now integrated a check and if reformime
doesn't create any file I reject the message.
Adjusting the indented X- fields to the beginning of the line
makes reformime decompose the message correctly in its parts, however.
Our customers Outlook managed to decode the message though. Luckily
they also have a local virus scanner running so no harm was done.
Is this a known problem? Is there a fix?
I am running reformime from maildrop version 1.3.4.
I have downloaded 1.3.5 and it has the same problem.
The bug is taking advantage of a MIME parsing bug in Outlook. The above
header line specifies a MIME multipart boundary delimiter that doesn't
really exist in the content of the mail (both of the X-header lines are
really syntactically a part of the MIME boundary delimiter), and that's why
reformime did not see any attachments. However, since Outlook does not
properly parse the MIME headers, it is fooled into thinking that the message
contains an attachment.
3 messages in net.sourceforge.lists.courier-maildrop[maildropl] Re: reformime decompositi...
