[Indimail-support] qmail-smtpd falsely identifying ODT attachments as SoBig.e Virus

[Adrian Offerman]

Messages both from the outside (port 25) and from inside (port 587) are
falsely refused by qmail-smtpd if containing an ODT (or epub?) file as
an attachment:

@40000000517b020b1c76200c tcpserver: pid 7629 from 92.46.29.105
@40000000517b020b1d1ecbbc tcpserver: ok 7629 0[145.124.61.126]25
fiera.example.com[92.46.29.105]:53283:maxperip=25
@40000000517b021631844adc qmail-smtpd: pid 7629 from
::ffff:92.46.29.105 virus/banned content: SoBig.e Virus:
MAIL from <exa...@example.com> RCPT <m...@mydomain.com>
Size: 2024818
@40000000517b0216318aa7c4 tcpserver: end 7629 status 0

Where is this coming from? Google doesn't give any hints at all, so it
might be specific to my installation.
Is it clamd? or maybe something else?
When I try to send such a message myself through port 587, my
Thunderbird almost immediately comes back with the same message:
An error occurred while sending mail. The mail server responded:
we don't accept email with the below content (#5.3.4)
Further Information: SoBig.e Virus. Please check the message and
try again.

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr
_______________________________________________
Indimail-support mailing list
Indimail...@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/indimail-support

[A. Offerman]

Just checked clamd in debugging mode: attachment appears to be clean:

@40000000517c488c090d2d44 $Got new connection, FD 8
@40000000517c488c090da274 $Received POLLIN|POLLHUP on fd 4
@40000000517c488c090da65c $fds_poll_recv: timeout after 5 seconds
@40000000517c488c090daa44 $Received POLLIN|POLLHUP on fd 8
@40000000517c488c090de8c4 $Receveived a file descriptor: 9
@40000000517c488c090e235c $got command FILDES (7, 11), argument:
@40000000517c488c090e2b2c $RECVTH: FILDES command complete
@40000000517c488c090f2144 $mode -> MODE_WAITREPLY
@40000000517c488c090f2cfc $Breaking command loop, mode is no longer
MODE_COMMAND
@40000000517c488c090f30e4 $Consumed entire command
@40000000517c488c090f34cc $Number of file descriptors polled: 1 fds
@40000000517c488c090f3c9c $THRMGR: queue (single) crossed low threshold
-> signaling
@40000000517c488c090fa614 $THRMGR: queue (bulk) crossed low threshold ->
signaling
@40000000517c488c090fade4 $fds_poll_recv: timeout after 600 seconds
@40000000517c488c090fb1cc LibClamAV debug: in cli_magic_scandesc
(reclevel: 0/16)
@40000000517c488c091084bc LibClamAV debug: cache_check:
ff9ef111998468aba929c0d147868cd5 is negative
@40000000517c488c09108c8c LibClamAV debug: Recognized Raw mail file
@40000000517c488c0910d2dc LibClamAV debug: Starting cli_scanmail(),
recursion = 1
@40000000517c488c0911e064 LibClamAV debug: in mbox()
@40000000517c488c09120b5c LibClamAV debug: parseEmailFile
@40000000517c488c0912132c LibClamAV debug: parseEmailFile: check
'Received: (indimail 18183 invoked from 2001:980:cee8:1:d63
d:7eff:fe4c:a94c by host services.offerman.com by uid 555); Sat, 27 Apr
2013 23:52:02 +0200' fullline (nil)
@40000000517c488c09126534 LibClamAV debug: parseEmailFile: check
'DKIM-Status: no signatures' fullline (nil)
@40000000517c488c09126d04 LibClamAV debug: parseEmailFile: check
'DomainKey-Status: no signature' fullline (nil)
@40000000517c488c091274d4 LibClamAV debug: parseEmailFile: check
'Received: from unknown (HELO vegas.nmoslabs.net)
(smtprelay@2001:980:cee8:1:d63d:7eff:fe4c:a94c)' fullline (nil)
@40000000517c488c09127ca4 LibClamAV debug: parseEmailFile: check ' by 0
with ESMTPSA; Sat, 27 Apr 2013 23:52:01 +0200' fullline (nil)
@40000000517c488c091297fc LibClamAV debug: parseEmailFile: check
'Message-ID: <517C4892...@offerman.com>' fullline (nil)
@40000000517c488c09129fcc LibClamAV debug: parseEmailFile: check 'Date:
Sat, 27 Apr 2013 23:52:18 +0200' fullline (nil)
@40000000517c488c0912a3b4 LibClamAV debug: parseEmailFile: check 'From:
"A. Offerman" <adr...@offerman.com>' fullline (nil)
@40000000517c488c0912ab84 LibClamAV debug: parseEmailFile: check
'Reply-To: adr...@offerman.com' fullline (nil)
@40000000517c488c0912c2f4 LibClamAV debug: parseEmailFile: check
'Organization: Offerman Consulting' fullline (nil)
@40000000517c488c0912fd8c LibClamAV debug: parseEmailFile: check
'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130402
Thunderbird/17.0.5' fullline (nil)
@40000000517c488c09130944 LibClamAV debug: parseEmailFile: check
'MIME-Version: 1.0' fullline (nil)
@40000000517c488c09131114 LibClamAV debug: parseEmailFile: check 'To:
Aad Offerman <adr...@example.net>' fullline (nil)
@40000000517c488c091318e4 LibClamAV debug: parseEmailFile: check
'Subject: Test ODT' fullline (nil)
@40000000517c488c09131ccc LibClamAV debug: parseEmailFile: check
'X-Enigmail-Version: 1.5.1' fullline (nil)
@40000000517c488c0913343c LibClamAV debug: parseEmailFile: check
'Content-Type: multipart/mixed;' fullline (nil)
@40000000517c488c09133c0c LibClamAV debug: parseEmailFile: check '
boundary="------------070208050503040902070408"' fullline 0x7fdf30001830
@40000000517c488c091343dc LibClamAV debug: parseEmailHeader
'Content-Type: multipart/mixed;
boundary="------------070208050503040902070408"'
@40000000517c488c09134bac LibClamAV debug: parseMimeHeader:
cmd='Content-Type', arg=' multipart/mixed;
boundary="------------070208050503040902070408"'
@40000000517c488c0913631c LibClamAV debug: messageSetMimeType: 'multipart'
@40000000517c488c09136704 LibClamAV debug: mimeArgs = '
boundary="------------070208050503040902070408"'
@40000000517c488c0913a584 LibClamAV debug: Add arguments '
boundary="------------070208050503040902070408"'
@40000000517c488c0913ad54 LibClamAV debug: messageAddArgument,
arg='boundary=------------070208050503040902070408'
@40000000517c488c0913b524 LibClamAV debug: parseEmailFile: check ''
fullline (nil)
@40000000517c488c0913b90c LibClamAV debug: End of header information
@40000000517c488c0913c0dc LibClamAV debug: newline_in_header, check
"This is a multi-part message in MIME format."
@40000000517c488c0913d84c LibClamAV debug: getline_from_mbox: fmap need
failed
@40000000517c488c0913dc34 LibClamAV debug: parseEmailFile: return
@40000000517c488c0913e01c LibClamAV debug: in parseEmailBody, 0 files
saved so far
@40000000517c488c0913e7ec LibClamAV debug: Parsing mail file
@40000000517c488c0913ebd4 LibClamAV debug: mimeType = 5
@40000000517c488c0913efbc LibClamAV debug: Content-type 'multipart' handler
@40000000517c488c0914360c LibClamAV debug: boundaryStart: found
------------070208050503040902070408 in
--------------070208050503040902070408
@40000000517c488c09143ddc LibClamAV debug: Now read in part 0
@40000000517c488c091441c4 LibClamAV debug: Multipart 0: About to parse
folded header 'Content-Type: text/plain; charset=ISO-8859-1'
@40000000517c488c09144994 LibClamAV debug: parseEmailHeader
'Content-Type: text/plain; charset=ISO-8859-1'
@40000000517c488c09145164 LibClamAV debug: parseMimeHeader:
cmd='Content-Type', arg=' text/plain; charset=ISO-8859-1'
@40000000517c488c09148814 LibClamAV debug: messageSetMimeType: 'text'
@40000000517c488c09148bfc LibClamAV debug: mimeArgs = ' charset=ISO-8859-1'
@40000000517c488c09148fe4 LibClamAV debug: Add arguments '
charset=ISO-8859-1'
@40000000517c488c091497b4 LibClamAV debug: messageAddArgument,
arg='charset=ISO-8859-1'
@40000000517c488c0914d24c LibClamAV debug: Discarding unwanted argument
'charset=ISO-8859-1'
@40000000517c488c0914da1c LibClamAV debug: Multipart 0: About to parse
folded header 'Content-Transfer-Encoding: 7bit'
@40000000517c488c0914e1ec LibClamAV debug: parseEmailHeader
'Content-Transfer-Encoding: 7bit'
@40000000517c488c0914e5d4 LibClamAV debug: parseMimeHeader:
cmd='Content-Transfer-Encoding', arg=' 7bit'
@40000000517c488c0914eda4 LibClamAV debug: messageSetEncoding: '7bit'
@40000000517c488c0914f18c LibClamAV debug: Encoding type 1 is "7bit"
@40000000517c488c09150514 LibClamAV debug: Multipart 0: End of header
information
@40000000517c488c09150ce4 LibClamAV debug: boundaryStart: found
------------070208050503040902070408 in
--------------070208050503040902070408
@40000000517c488c091514b4 LibClamAV debug: Part 0 has 2 lines, rc = 1
@40000000517c488c0915189c LibClamAV debug: Mixed message part 0 is of type 6
@40000000517c488c0915206c LibClamAV debug: Mixed message text part
disposition ""
@40000000517c488c091533f4 LibClamAV debug: Mime subtype "plain"
@40000000517c488c091537dc LibClamAV debug: Adding part to main message
@40000000517c488c09153fac LibClamAV debug: messageToFileblob
@40000000517c488c09154394 LibClamAV debug: messageExport:
numberOfEncTypes == 1
@40000000517c488c09157e2c LibClamAV debug: messageExport: enctype 0 is 0
@40000000517c488c09158214 LibClamAV debug: Attachment sent with no filename
@40000000517c488c091585fc LibClamAV debug: messageAddArgument,
arg='name=attachment'
@40000000517c488c09158dcc LibClamAV debug: blobSetFilename: attachment
@40000000517c488c091591b4 LibClamAV debug: fileblobSetFilename: file
attachment saved to
/tmp/clamav-3f2a1cd46089745dedec9eb6edafaf8e/clamav-35362b66b5116691def1602b5ad966cd
@40000000517c488c0915d034 LibClamAV debug: textToFileBlob to attachment,
destroy = 1
@40000000517c488c09165cd4 LibClamAV debug: in cli_magic_scandesc
(reclevel: 1/16)
@40000000517c488c09169b54 LibClamAV debug: cache_check:
d85f4fad82a9f06370a946c57370efa4 is negative
@40000000517c488c0916d5ec LibClamAV debug: Recognized ASCII text
@40000000517c488c091b2b4c LibClamAV debug: hashtab: Freeing hashset,
elements: 0, capacity: 0
@40000000517c488c091b331c LibClamAV debug: in cli_scanscript()
@40000000517c488c09223414 LibClamAV debug: hashtab: Freeing hashset,
elements: 0, capacity: 0
@40000000517c488c09227a64 LibClamAV debug: cache_add:
d85f4fad82a9f06370a946c57370efa4 (level 0)
@40000000517c488c09228234 LibClamAV debug: cli_magic_scandesc: returning
0 at line 2460
@40000000517c488c0922861c LibClamAV debug:
/tmp/clamav-3f2a1cd46089745dedec9eb6edafaf8e/clamav-35362b66b5116691def1602b5ad966cd
is clean
@40000000517c488c09228dec LibClamAV debug: fileblobDestructiveDestroy:
/tmp/clamav-3f2a1cd46089745dedec9eb6edafaf8e/clamav-35362b66b5116691def1602b5ad966cd
@40000000517c488c09232a2c LibClamAV debug: Now read in part 0
@40000000517c488c092331fc LibClamAV debug: Multipart 0: About to parse
folded header 'Content-Type: application/vnd.oasis.opendocument.text;
name="aan_de_slag-cursus0.odt"'
@40000000517c488c092339cc LibClamAV debug: parseEmailHeader
'Content-Type: application/vnd.oasis.opendocument.text;
name="aan_de_slag-cursus0.odt"'
@40000000517c488c0923801c LibClamAV debug: parseMimeHeader:
cmd='Content-Type', arg=' application/vnd.oasis.opendocument.text;
name="aan_de_slag-cursus0.odt"'
@40000000517c488c092387ec LibClamAV debug: messageSetMimeType: 'application'
@40000000517c488c09238fbc LibClamAV debug: mimeArgs = '
name="aan_de_slag-cursus0.odt"'
@40000000517c488c092393a4 LibClamAV debug: Add arguments '
name="aan_de_slag-cursus0.odt"'
@40000000517c488c0923e5ac LibClamAV debug: messageAddArgument,
arg='name=aan_de_slag-cursus0.odt'
@40000000517c488c0923ed7c LibClamAV debug: Multipart 0: About to parse
folded header 'Content-Transfer-Encoding: base64'
@40000000517c488c0923f54c LibClamAV debug: parseEmailHeader
'Content-Transfer-Encoding: base64'
@40000000517c488c0923f934 LibClamAV debug: parseMimeHeader:
cmd='Content-Transfer-Encoding', arg=' base64'
@40000000517c488c09240104 LibClamAV debug: messageSetEncoding: 'base64'
@40000000517c488c092404ec LibClamAV debug: Encoding type 1 is "base64"
@40000000517c488c09241c5c LibClamAV debug: Multipart 0: About to parse
folded header 'Content-Disposition: attachment;
filename="aan_de_slag-cursus0.odt"'
@40000000517c488c0924242c LibClamAV debug: parseEmailHeader
'Content-Disposition: attachment; filename="aan_de_slag-cursus0.odt"'
@40000000517c488c09245ec4 LibClamAV debug: parseMimeHeader:
cmd='Content-Disposition', arg=' attachment;
filename="aan_de_slag-cursus0.odt"'
@40000000517c488c09246a7c LibClamAV debug: messageAddArgument,
arg='filename="aan_de_slag-cursus0.odt"'
@40000000517c488c09246e64 LibClamAV debug: Multipart 0: End of header
information
@40000000517c488c09247634 LibClamAV debug: Part 0 has 1 lines, rc = 1
@40000000517c488c09247a1c LibClamAV debug: Mixed message part 0 is of type 1
@40000000517c488c09247e04 LibClamAV debug: messageToFileblob
@40000000517c488c0924918c LibClamAV debug: messageExport:
numberOfEncTypes == 1
@40000000517c488c0924995c LibClamAV debug: messageExport: enctype 0 is 2
@40000000517c488c09249d44 LibClamAV debug: blobSetFilename:
aan_de_slag-cursus0.odt
@40000000517c488c0924d7dc LibClamAV debug: fileblobSetFilename: file
aan_de_slag_cursus0.odt saved to
/tmp/clamav-3f2a1cd46089745dedec9eb6edafaf8e/clamav-550cd1995c1ecf9e308642fa1bcb2297
@40000000517c488c0924e394 LibClamAV debug: sanitiseBase64
'UEsDBBQAAAgAAAhYuUBexjIMJwAAACcAAAAIAAAAbWltZXR5cGVhcHBsaWNhdGlvbi92bmQu'
@40000000517c488c09251e2c LibClamAV debug: Exported 54 bytes using enctype 2
@40000000517c488c092558c4 LibClamAV debug: in cli_magic_scandesc
(reclevel: 1/16)
@40000000517c488c09258b8c LibClamAV debug: cache_check:
68b67d46a9309342d7a5c3d0cea3bfab is negative
@40000000517c488c0925c624 LibClamAV debug: Recognized ZIP file
@40000000517c488c0925ca0c LibClamAV debug: in cli_unzip
@40000000517c488c0926bc3c LibClamAV debug: cli_unzip: central not found,
using localhdrs
@40000000517c488c0926c024 LibClamAV debug: cli_unzip: lh -
ZMDNAME:0:mimetype:39:39:c32c65e:0:1:2
@40000000517c488c0927028c LibClamAV debug: cli_unzip: lh - stream out of
file
@40000000517c488c0928a09c LibClamAV debug: Matched signature for file
type ZIP-SFX at 0
@40000000517c488c092afa2c LibClamAV debug: hashtab: Freeing hashset,
elements: 0, capacity: 0
@40000000517c488c092b38ac LibClamAV debug: cache_add:
68b67d46a9309342d7a5c3d0cea3bfab (level 0)
@40000000517c488c092b407c LibClamAV debug: cli_magic_scandesc: returning
0 at line 2460
@40000000517c488c092b4464 LibClamAV debug:
/tmp/clamav-3f2a1cd46089745dedec9eb6edafaf8e/clamav-550cd1995c1ecf9e308642fa1bcb2297
is clean
@40000000517c488c092b82e4 LibClamAV debug: fileblobDestructiveDestroy:
/tmp/clamav-3f2a1cd46089745dedec9eb6edafaf8e/clamav-550cd1995c1ecf9e308642fa1bcb2297
@40000000517c488c092bbd7c LibClamAV debug: The message has 0 parts
@40000000517c488c092bc54c LibClamAV debug: cli_mbox returning 0
@40000000517c488c093352e4 LibClamAV debug: Matched signature for file
type Mail file
@40000000517c488c0936e8dc LibClamAV debug: hashtab: Freeing hashset,
elements: 0, capacity: 0
@40000000517c488c0937275c LibClamAV debug: cache_add:
ff9ef111998468aba929c0d147868cd5 (level 0)
@40000000517c488c09372b44 LibClamAV debug: cli_magic_scandesc: returning
0 at line 2460
@40000000517c488c093765dc fd[9]: OK
@40000000517c488c093765dc $Closed fd 9
@40000000517c488c093769c4 $Finished scanthread
@40000000517c488c0937bbcc $Scanthread: connection shut down (FD 8)
@40000000517c488c0937bfb4 $THRMGR: queue (single) crossed low threshold
-> signaling
@40000000517c488c0937c784 $THRMGR: queue (bulk) crossed low threshold ->
signaling

[Manvendra Bhangui]

On 28 Apr 2013 03:30, "Adrian Offerman" <adr...@offerman.net> wrote:
>
>
> Messages both from the outside (port 25) and from inside (port 587) are
> falsely refused by qmail-smtpd if containing an ODT (or epub?) file as
> an attachment:
>
> @40000000517b020b1c76200c tcpserver: pid 7629 from 92.46.29.105
> @40000000517b020b1d1ecbbc tcpserver: ok 7629 0[145.124.61.126]25
>     fiera.example.com[92.46.29.105]:53283:maxperip=25
> @40000000517b021631844adc qmail-smtpd: pid 7629 from
>     ::ffff:92.46.29.105 virus/banned content: SoBig.e Virus:
>     MAIL from <exa...@example.com> RCPT <m...@mydomain.com>
>     Size: 2024818
> @40000000517b0216318aa7c4 tcpserver: end 7629 status 0
>
> Where is this coming from? Google doesn't give any hints at all, so it
> might be specific to my installation.
> Is it clamd? or maybe something else?
> When I try to send such a message myself through port 587, my
> Thunderbird almost immediately comes back with the same message:
>   An error occurred while sending mail. The mail server responded:
>   we don't accept email with the below content (#5.3.4)
>   Further Information: SoBig.e Virus. Please check the message and

Edit the file /var/indimail/control/signatures and comment out the entry for SoBig.e.

This is coming from the inline virus scanner code in qmail-smtpd

[Adrian Offerman]

Thanks! just checked: ODT files can be send and received now :-)

Here another link discussing the very same issue with basic pattern
matching:
http://bugs.contribs.org/show_bug.cgi?id=6045

Why would one want to enable a pattern that causes ODT, epub and other
attachments to be rejected? Or is it a legacy -- SoBig had its heydays a
decade ago -- that just needs to be cleaned out?

On 04/28/2013 06:12 AM, Manvendra Bhangui wrote:
>
> On 28 Apr 2013 03:30, "Adrian Offerman" <adr...@offerman.net

> <mailto:adr...@offerman.net>> wrote:
>>
>>
>> Messages both from the outside (port 25) and from inside (port 587) are
>> falsely refused by qmail-smtpd if containing an ODT (or epub?) file as
>> an attachment:
>>
>> @40000000517b020b1c76200c tcpserver: pid 7629 from 92.46.29.105
>> @40000000517b020b1d1ecbbc tcpserver: ok 7629 0[145.124.61.126]25
>> fiera.example.com

> <http://fiera.example.com>[92.46.29.105]:53283:maxperip=25

>> @40000000517b021631844adc qmail-smtpd: pid 7629 from
>> ::ffff:92.46.29.105 virus/banned content: SoBig.e Virus:

>> MAIL from <exa...@example.com <mailto:exa...@example.com>> RCPT
> <m...@mydomain.com <mailto:m...@mydomain.com>>

>> Size: 2024818
>> @40000000517b0216318aa7c4 tcpserver: end 7629 status 0
>>
>> Where is this coming from? Google doesn't give any hints at all, so it
>> might be specific to my installation.
>> Is it clamd? or maybe something else?
>> When I try to send such a message myself through port 587, my
>> Thunderbird almost immediately comes back with the same message:
>> An error occurred while sending mail. The mail server responded:
>> we don't accept email with the below content (#5.3.4)
>> Further Information: SoBig.e Virus. Please check the message and
>
> Edit the file /var/indimail/control/signatures and comment out the entry
> for SoBig.e.
>
> This is coming from the inline virus scanner code in qmail-smtpd

[Manvendra Bhangui]

On Sun, Apr 28, 2013 at 3:36 PM, Adrian Offerman <adr...@offerman.net> wrote:

Thanks! just checked: ODT files can be send and received now :-)

Here another link discussing the very same issue with basic pattern
matching:
  http://bugs.contribs.org/show_bug.cgi?id=6045

Why would one want to enable a pattern that causes ODT, epub and other
attachments to be rejected? Or is it a legacy -- SoBig had its heydays a
decade ago -- that just needs to be cleaned out?

It is legacy and I thing the pattern was put without a proper research into the zip file format. You can see the discussion in the yahoo group link I have provided below.

http://tech.groups.yahoo.com/group/djb-qmail/message/111458 

Just before you had this bug, I got an email from another user facing exactly the same problem. It looks like that the pattern is hitting innocent zip files.

I have removed two such patterns from the build. You may want to remove the pattern for mydoom also.

UEsDBBQAA:SoBig.e Virus

UEsDBAoAAA:mydoom Virus