bugtraq id 3133

[Christian Julien <christian.julien () enac fr>]

I have ask Trend Micro to put an option regarding InterScan VirusWall
decoding errors:

it could be:

in case of decoding error:

- bypass scanning (default)
or
- move document in some place and let administrator decide what to do
with it.


There were an option "Block messages when scan engine encounters
decoding error" at 3.02 level, but default was to move document.
I imagine that ISP felt constrained by default behaviour. From that,
this option disappears.
I have ask for it to come back in vain since May 2000.
paja () integralis cz post proves this option is realy missing.

> Trend Micro InterScan VirusWall is unable to filter or clean the
>  TROJ_SIRCAM.A virus from attachments in electronic mail format
>  (.eml).
>
>  This vulnerability is due to a problem with InterScan's ability to decode
>  certain attachment types.

Regards,
Christian Julien
 | site:       christian.julien () enac fr
 | enterprise: christian.julien () synstar fr