False positives "text/plain,.exe"

[Olivier Nicole]

Tilman Schmidt <tschmidt at cardtech.de> writes:

> That's cute: when I got my copy of that message back from the list
> processor it was also flagged as containing a text/plain,.exe
> attachment. So whatever it is that leads Amavis to this conclusion,
> it survives being included verbatim in the body of another
> text/plain mail.

I got it delivered OK. Did you change some configuration of Amavis
recently? An automatic update of the package?

Olivier


> On 26.04.2016 12:47, Tilman Schmidt wrote:
>> 
>> On 26.04.2016 12:28, Olivier Nicole wrote:
>>> Tilman Schmidt <tschmidt at cardtech.de> writes:
>>>
>>>> On our mailserver, Amavis is quarantining a lot of mails claiming that
>>>> they contain a banned attachment of type "text/plain,.exe" even though,
>>>> when inspecting the quarantined mail, they turn out not to contain any
>>>> attachment at all, not even an image or signature, just "text/plain"
>>>> and possibly "text/html" within "multipart/alternative".
>> [...]
>>> That would request an example I think
>> 
>> No prob, this here comes straight from my quarantine folder. The
>> message itself came from the mailing list, so I consider it public.
>> I just deleted the (internal) recipient address. Hope it goes through
>> sufficiently unmangled:
> [snipped to avoid another round of bans]
>

--