PDA

View Full Version : Fragmented Messages and Executable Content Filters


Dunx
09-13-2002, 10:08 AM
I've had the mail filter which bounces executable content turned on for some time now, on the grounds that such attachments almost always contain a virus. However, there's a story in The Register today about Outlook enabling a fragmented message feature -

http://www.theregister.co.uk/content/55/27095.html

The story suggests that this might be used to sneak viri past content filters, but would such a tweak get past the executabe attachment bouncer?

Bruce
09-13-2002, 12:56 PM
I would have to actually see such a fragmented attachment in its entirety to be certain, but as far as I understand from my reading, at least the first part would contain the executable filename. It is this filename that is the key used by FutureQuest's executable attachment filter. Therefore, the filter would still reject at least the first part, rendering the attachment useless.

Dunx
09-13-2002, 06:24 PM
That's good to know - thanks.

The impression I get is that this is not a widely used feature, but one member of our household uses Outlook so I thought I'd better check.