Empty attachments - BAD HEADER SECTION, MIME error: error: part did not end with expected boundary

[Alex Dyas]

Hello,

Environment :
- Ubuntu - 10.04.3 LTS
- Postfix - 2.7.0-1ubuntu0.2
- Amavis - 1:2.6.4-1ubuntu5
- Spam Assassin - 3.3.1-1
- ClamAV - 0.96.5+dfsg-1ubuntu1.10.04.3

Symptoms - A couple of emails per day come through the system with empty 
attachments.  They have the following line in their header:

X-Amavis-Alert: BAD HEADER SECTION, MIME error: error: part did not end 
with expected boundary

- I have not been able to reproduce the problem myself
- Problematic mails re-sent often come through without problem, ie with 
the attachment
- The offending mails generate ClamAV quarantine files, but even these 
don't contain the attachments
- If I receive the same emails at a different account on an unrelated 
system I see the attachment perfectly well
- We see the same issue from a number of unrelated senders

Sample header (anonymised):

 From xxxxxx at xxx.com  Tue May 15 07:41:14 2012
Return-Path: <xxxxxx at xxx.com>
X-Original-To: dump at proxy.yyyyy.com
Delivered-To: dump at proxy.yyyyy.com
Received: from localhost (localhost [127.0.0.1])
         by mail.yyyyy.com (Postfix) with ESMTP id 170554C16E9;
         Tue, 15 May 2012 07:41:14 +0200 (CEST)
X-Quarantine-ID: <Px1M0jVRJetN>
X-Virus-Scanned: Debian amavisd-new at yyyyy.com
X-Amavis-Alert: BAD HEADER SECTION, MIME error: error: part did not end 
with expected boundary
X-Spam-Flag: NO
X-Spam-Score: -1.911
X-Spam-Level:
X-Spam-Status: No, score=-1.911 tagged_above=-100 required=6.31
         tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01]
         autolearn=ham
Received: from mail.yyyyy.com ([127.0.0.1])
         by localhost (yyyyy.com [127.0.0.1]) (amavisd-new, port 10024)
         with ESMTP id Px1M0jVRJetN; Tue, 15 May 2012 07:41:11 +0200 (CEST)
Received: by mail.yyyyy.com (Postfix, from userid 1002)
         id BBE204C03D1; Tue, 15 May 2012 07:41:11 +0200 (CEST)
Received: from mail1.xxx.com (mail1.xxx.com [11.22.33.44])
         by mail.yyyyy.com (Postfix) with ESMTP id 98EBC4C03D1;
         Tue, 15 May 2012 07:41:11 +0200 (CEST)
From: XXXX XXXXX <xxxxxx at xxx.com>
Subject: News
Thread-Topic: News
Thread-Index: Ac0yXHvsAZ0A5DlqQrO9zy68+EZRewAANCFg
Date: Tue, 15 May 2012 05:41:08 +0000
Message-ID: <19D32E934240BC45AD953862CE86FA3701285833 at qqqq.xxx.com>
References: <4CDB5B433E87004CBA5E07997B4BF6C70639FEDD at qqqq.xxx.com>
In-Reply-To: <4CDB5B433E87004CBA5E07997B4BF6C70639FEDD at qqqq.xxx.com>
Accept-Language: de-CH, en-US
Content-Language: de-DE
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Content-Type: multipart/mixed;
         boundary="_004_19D32E934240BC45AD953862CE86FA3701285833ASDJKFK"
MIME-Version: 1.0
To: Undisclosed recipients:;
X-Copyrighted-Material: None

--_004_19D32E934240BC45AD953862CE86FA3701285833ASDJKFK
Content-Type: multipart/alternative;
         boundary="_004_19D32E934240BC45AD953862CE86FA3701285833ASDJKFK"

--_004_19D32E934240BC45AD953862CE86FA3701285833ASDJKFK
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
.....

After some Googling I found the following configuration :

(/etc/amavis/conf.d/21-ubuntu_defaults)
@bypass_header_checks_maps = (1);
$bad_header_quarantine_to = undef;

But this doesn't seem to help.

Can anyone give me any hints as to where to look?

Thanks in advance,

Alex

-- 
Alex Dyas, Manager - Systems Administration
Tel: +41 22 348 30 15
www.linalis.com | twitter.com/linalis | www.linkedin.com/company/linalis

Expert en Services, Formation et Recrutement BI et Applications Web 
(CMS, CRM)
Partenaires certifies de Pentaho (BI), Jedox (Palo), Acquia (Drupal), 
SugarCRM et Infobright