[22370] in bugtraq
bugtraq id
daemon@ATHENA.MIT.EDU (Christian Julien)
Wed Aug 22 11:31:15 2001
Message-ID: <3B837E76.65587F22@enac.fr>
Date: Wed, 22 Aug 2001 11:42:14 +0200
From: Christian Julien <christian.julien@enac.fr>
MIME-Version: 1.0
To: BUGTRAQ@securityfocus.com
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
I have ask Trend Micro to put an option regarding InterScan VirusWall
decoding errors:
it could be:
in case of decoding error:
- bypass scanning (default)
or
- move document in some place and let administrator decide what to do
with it.
There were an option "Block messages when scan engine encounters
decoding error" at 3.02 level, but default was to move document.
I imagine that ISP felt constrained by default behaviour. From that,
this option disappears.
I have ask for it to come back in vain since May 2000.
paja@integralis.cz post proves this option is realy missing.
> Trend Micro InterScan VirusWall is unable to filter or clean the
> TROJ_SIRCAM.A virus from attachments in electronic mail format
> (.eml).
>
> This vulnerability is due to a problem with InterScan's ability to decode
> certain attachment types.
Regards,
Christian Julien
| site: christian.julien@enac.fr
| enterprise: christian.julien@synstar.fr
