Kenneth Oncinian wrote:
> Hi List,
> 
> We prohibit certain type of files as attachments or as archived in any
> format, for example, executable files.
> However, as user notice this due to bounce messages, they are now embedding
> executables to MS office documents
> and thus bypassing the file type prohibit rule.
> Is there a way for amavisd-new to detect and reject these kind of
> attachments as well?
> 
> best regards,
> Kenneth

The file utility shows these files as ordinary Microsoft Office 
Documents.  However, they have an Package Embed section within them, 
which is not identified by file.

I started looking at the format of the .doc file with the embed, but 
haven't come up with a definitive pattern yet to allow file to match, so 
that a reject rule can be created for amavis.

If I have more time later, I'll take a take another look with fresher 
eyes.  Perhaps someone will come up with the magic pattern by then.

MrC

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
AMaViS-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/

Reply via email to