Office 2007/2010 Attachment recognition in 7.5

Unanswered Question
Jan 24th, 2012

Since upgrading we are finding problems with Ironport detecting .bin files in docx, xlsx etc. I know that these files are technically zip files and when an Excel spreadsheet has a macro it will carry a .bin file etc. The problem is that this was "fixed" in around 2008 when MS first introduced these attachment types. Why does 7.5 re-introduce this problem?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 0 (0 ratings)
doug.l.maxfield Wed, 01/25/2012 - 06:26

Daryl,

I'm running into the same problem after the upgrade.  Have you found any solution to the problem?  It is causing us a major "headache".

Doug

ironport99 Wed, 01/25/2012 - 06:35

Doug,

The response I got was that this is a "feature" of 7.5.

One possibility to bypass office documents is the a message filter condition

like following:

if (attachment-filename !=

"(?i)\.(docx|docm|dotx|dotm|xlsx|xlsm|xltm|xlsb|xlam|pptx|pptm|potx|potm|ppa

m|ppsx|ppsm")

Another possibility is to use a content filter condition

Attachment Name Does not End With

(?i)\.(docx|docm|dotx|dotm|xlsx|xlsm|xltm|xlsb|xlam|pptx|pptm|potx|potm|ppam

|ppsx|ppsm)

Unfortunately there is no other way to bypass Office documents with macros

as long as you have a filter for executable files.

doug.l.maxfield Wed, 01/25/2012 - 10:56

Daryl,

I opened a ticket with TAC.  This has been flagged as a bug:

The behavior you are reporting is tracked in our bug database as defect 81190

It will be fixed in a coming MR.

ironport99 Thu, 01/26/2012 - 01:08

Thanks Doug for the info. It was the TAC that told me this was a feature that wouldn't be fixed !!!

doug.l.maxfield Thu, 02/09/2012 - 11:04

Daryl,

If you can get access to the AsyncOS 7.6.0 for Email FCS, the Office attachment problem is fixed.  We deployed it last night and have not had any issues.

Doug

DKOwens52 Tue, 02/21/2012 - 14:26

We are also experiencing this issue with 7.5.1 and Office files.

Doug Maxfield, I did not see this fix listed on the 7.6.0 FCS announcement, can you confirm that the 7.6.0 release does correct this bug?

Thanks

David

doug.l.maxfield Tue, 02/21/2012 - 14:30

David,

I asked the same questions when 7.6 FCS was released.  The response that I received back was that not all "bug" that are fixed are included in the Readme.

I can confirm 100% that the issue is resolved.

Doug

Actions

Login or Register to take actions

This Discussion

Posted January 24, 2012 at 3:33 AM
Stats:
Replies:10 Avg. Rating:
Views:1552 Votes:0
Shares:0
Tags: No tags.

Discussions Leaderboard