Re: NAI WebShield SMTP does not scan base64 encoding

[aleph1 () SECURITYFOCUS COM (Elias Levy)]

This is a summary of replies to this thread.

The are several tools to decode TNEF encoding:

- TNEF by Mark Simpson
  (this code is under the GLP)
  http://world.std.com/~damned/software.html
  http://freshmeat.net/appindex/1999/10/13/939847359.html

- Fentum (for Windows 95, Linux and source; watch those N's).
  http://www.fentun.com

- LS-TENF: a Java based TNEF decoder
  http://www.mirrorworlds.com/tnef/lstnef.zip

- The Convert::TNEF perl module by Doug Wilson; see CPAN

- Another TNEF decoder from Thomas Boll <tb () boll ch> is available at
  http://slappy.org/listarchives/xfmail/1999-October/000273.html

Information on TNEF:

- TNEF Specification
  (MS claims its been documented in MSDN for several years)
  http://msdn.microsoft.com/library/default.asp?URL=/library/psdk/mapi/apptnef_1cv3.htm

- Decoding Internet Attachments
  (includes information on TNEF)
  http://pages.prodigy.net/michael_santovec/decode.htm

Also, a number of SMTP-based mail scanning products scan TNEF in shipping
versions.

It seems the problem has been fixed in the latest version of the product.
Version 4.5 with DAT version 4.0.4082 appears to work correctly.

Thanks to:

Lars Hecking <lhecking () nmrc ucc ie>
MCKILLICAN, DONALD <donald.mckillican () bell ca>
DANIEL RAMIREZ VALDEZ <dramirez () cemtec com>
-DAL- <dylan () 1stup com>
David Lemson <dlemson () Exchange Microsoft com>
Eric Sherrill <sherrill () ti com>
Jim Knoble <jmknoble () pint-stowp cx>
Rainer Link <link () foo fh-furtwangen de>
H D Moore <secureaustin () CONSULTANT COM>
Chris Freels <CFreels () CDDB com>
Chad Kitching <CKitching () powerland mb ca>

--
Elias Levy
SecurityFocus.com
http://www.securityfocus.com/
Si vis pacem, para bellum