Page 1 of 1

Some dangerous files can go trought

Posted: 17 Oct 2017 15:45
by wines
Hello,

Today I found 2 issues and I hope that you can help me to solve it.

1) If MailScanner gets file with spaces in filename e.g. “Purchase Order.rar” it thinks that file name is just "Purchase" and do not unpack it. Today one of my users got virus on his PC in this way.

2) If you have 2 identical exe files in to separate archives, MailScanner will block only one of them, the rest will get to your network.

I hope that you know how to deal with it, because I could not find any useful in Google.

Thank you

Re: Some dangerous files can go trought

Posted: 17 Oct 2017 16:08
by wines
I found solution how to block files without extension, but it also block files with spaces in filename. So it's not very good.

Re: Some dangerous files can go trought

Posted: 17 Oct 2017 22:21
by shawniverson
1) Is fixed in the latest MailScanner 5.0.6-5 (eFa 3.0.2.5)

2) Try the latest version and report back whether this issue still exists.

Re: Some dangerous files can go trought

Posted: 18 Oct 2017 06:58
by wines
Thank you for replay. Latest MailScanner installation fixed my first problem.
But the 2nd problem is still actual.

Re: Some dangerous files can go trought

Posted: 18 Oct 2017 13:15
by shawniverson
Thank you. Can you provide me some steps? I want to reproduce this exact problem and inform MailScanner devs about this one.

Re: Some dangerous files can go trought

Posted: 18 Oct 2017 16:47
by wines
I've put notepad.exe in archive named "notepad.rar" using winrar 5.50 and made a copy of this archive "notepad - Copy.rar". Then I send this 2 archives in one mail trough my mail gateway. "notepad.rar" was blocked and "notepad - Copy.rar" was not.

Re: Some dangerous files can go trought

Posted: 18 Oct 2017 18:05
by shawniverson
Got it, thanks, I will see about escalating this.

Re: Some dangerous files can go trought

Posted: 18 Oct 2017 18:06
by shawniverson

Re: Some dangerous files can go trought

Posted: 22 Nov 2018 13:14
by daemon2k
Hello. Any news?
eFa 3.0.2.6 have same problems with rar attachement with spaces inside name of file. Exe files in such rar files doesn't check clamav ((
Please need fix ASAP.

Re: Some dangerous files can go trought

Posted: 28 Nov 2018 06:51
by endokard
The same problem. I've created new post.

Re: Some dangerous files can go trought

Posted: 03 Dec 2018 12:28
by endokard
Problem solved with MailScanner update