[Mimedefang] message/partial

[Carlton Thomas]

On Thu, 2 Dec 2004, Aleksandar Milivojevic wrote:

> If the email is JPEG image, as in your case, there's no harm.  However,
> if the email contains virus, and it is sent as message/partial, it can't
> be detected by virus scanners.  Theoreticall, each mail could contain
> only one byte of the actuall virus code.  There's no way for virus
> scanners to scan such an email.  Most commercial anti-virus tools will
> block message/partial by default also.  None that I know of will attempt
> to reassemble the email.
>

We advise our clients to send multi-part messages to overcome the
10 meg limit we impose on a single message. We understand that this
can allow viruses to slip through our defences, but we had to impose
a limit and we had to find some way of allowing messages larger than
that limit to be sent.

One possible solution to handle viruses in these types of messages is
to create a mimedefang filter which recognises the first part of a
multipart message and impose a minimum size limit on that part.
This is consistent with the assumption that most messages which
contain viruses tend to be small. Mimedefang currently allows the
admin to make that assumption and to only scan messages below a
certain size.

Would this be a suitable compromise, and is it possible to implement
it using in a mimedefang filter?

Regards !

--
Carlton
=============================
GIFFORD INTERNET SERVICES
Bristol, United Kingdom
Tel: 0845 111 0032
Tel: 0117 939 7722
Fax: 0845 111 0033
Email: admin at gifford.co.uk
Web: http://www.gifford.co.uk
=============================