Office 2007/2010 Attachment recognition in 7.5

Unanswered Question
Jan 24th, 2012
User Badges:

Since upgrading we are finding problems with Ironport detecting .bin files in docx, xlsx etc. I know that these files are technically zip files and when an Excel spreadsheet has a macro it will carry a .bin file etc. The problem is that this was "fixed" in around 2008 when MS first introduced these attachment types. Why does 7.5 re-introduce this problem?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Doug Maxfield Wed, 01/25/2012 - 06:26
User Badges:

Daryl,

I'm running into the same problem after the upgrade.  Have you found any solution to the problem?  It is causing us a major "headache".


Doug

ironport99 Wed, 01/25/2012 - 06:35
User Badges:

Doug,


The response I got was that this is a "feature" of 7.5.


One possibility to bypass office documents is the a message filter condition

like following:

if (attachment-filename !=

"(?i)\.(docx|docm|dotx|dotm|xlsx|xlsm|xltm|xlsb|xlam|pptx|pptm|potx|potm|ppa

m|ppsx|ppsm")


Another possibility is to use a content filter condition

Attachment Name Does not End With

(?i)\.(docx|docm|dotx|dotm|xlsx|xlsm|xltm|xlsb|xlam|pptx|pptm|potx|potm|ppam

|ppsx|ppsm)


Unfortunately there is no other way to bypass Office documents with macros

as long as you have a filter for executable files.

Doug Maxfield Wed, 01/25/2012 - 06:50
User Badges:

Daryl,

Thanks for the update.


That's what I was afraid of. 


Doug

Doug Maxfield Wed, 01/25/2012 - 10:56
User Badges:

Daryl,

I opened a ticket with TAC.  This has been flagged as a bug:


The behavior you are reporting is tracked in our bug database as defect 81190


It will be fixed in a coming MR.

ironport99 Thu, 01/26/2012 - 01:08
User Badges:

Thanks Doug for the info. It was the TAC that told me this was a feature that wouldn't be fixed !!!

Doug Maxfield Thu, 02/09/2012 - 11:04
User Badges:

Daryl,

If you can get access to the AsyncOS 7.6.0 for Email FCS, the Office attachment problem is fixed.  We deployed it last night and have not had any issues.


Doug

David Owens Tue, 02/21/2012 - 14:26
User Badges:

We are also experiencing this issue with 7.5.1 and Office files.


Doug Maxfield, I did not see this fix listed on the 7.6.0 FCS announcement, can you confirm that the 7.6.0 release does correct this bug?


Thanks

David

Doug Maxfield Tue, 02/21/2012 - 14:30
User Badges:

David,

I asked the same questions when 7.6 FCS was released.  The response that I received back was that not all "bug" that are fixed are included in the Readme.


I can confirm 100% that the issue is resolved.


Doug

Doug Maxfield Wed, 02/22/2012 - 14:33
User Badges:

David,

Here's the bug number for the Office Attachment problem:  defect 81190


Doug

Actions

This Discussion