Re: Strange things with a strange mail (received from bugbear)

From: Bjarni R. Einarsson (
Date: Wed 09 Oct 2002 - 16:34:24 GMT

  • Next message: Bjarni R. Einarsson: "Re: Dropping infected emails..."

    On 2002-10-07, 17:32:05 (+0200), avincze wrote:
    > We use Anomy 1.49 with procmail (.forward file), and so far it seemed that
    > Anomy worked well.
    > However, now a strange thing happened:
    > - I saw an attachment named 'Camping France.txt.pif' in the carbon copy of
    > the mailbox of a user
    > So,
    > - why Anomy truncated the filename of the attachment?
    > - where did that file disappear after Anomy ACCEPTED it?

    This is a problem with incorrect MIME encoding:

    > ------------ISY0VH6VL9J18YU
    > Content-Type: audio/x-midi;
    > name=Camping France.txt.pif
    > Content-Transfer-Encoding: base64

    As you can see, there are no quotation marks (") surrounding the
    file name and it's not actually clear what is the "correct" way to
    parse headers like this one.

    The Anomy behavior is not consistant with that of Outlook, but I
    don't believe it is actually incorrect either.

    At any rate, the failure mode is "safe" - the result of problems
    like this should be that the ignored bit ("France.txt.pif") is
    stripped off and the recipient should receive the attachment with
    the filename "Camping", which should be unrecognized by the OS.

    Bjarni R. Einarsson                           PGP: 02764305, B7A3AB89                -><-    

    Check out my open-source email sanitizer: Spammers, please send plenty of email to:

    hosted by