Very long filenames are good signs of attacks against Microsoft e-mail packages (Reg No -2016%2.png)

[ovizii]

Mailscanner blocked an attachment with:

MailScanner: Very long filenames are good signs of attacks against Microsoft e-mail packages (Reg No -2016%2.png)

so I checked: /etc/MailScanner/filename.rules.conf and the rule triggered is:

# Due to a bug in Outlook Express, you can make the 2nd from last extension
# be what is used to run the file. So very long filenames must be denied,
# regardless of the final extension.
deny .{150,} Very long filename, possible OE attack Very long filenames are good signs of attacks against Microsoft e-mail packages

not sure how a file name of Reg No -2016%2.png triggers that, is it the % character maybe?

[shawniverson]

That one is very weird. I think we should post throw this one at the MailScanner team.

[ovizii]

https://github.com/MailScanner/v5/issues/48

[ovizii]

solved. the file name was indeed very long, the Mailwatch interface actually only shows it in a short form.