winmail.dat attachments

We're seeing an increasing problem with mail arriving with
a
"winmail.dat" attachment being blocked. These are
attachments that are
only generated by or understood by Outlook clients and/or
Exchange
servers. These files contain formatting information and
sometimes other
attachments in a compressed format.

The only fix for this that doesn't require some source code
hacking
would be to remove .dat from the list of banned attachments,
but this is
too risky. .dat files can contain nearly anything, including
registry
keys (see ntusers.dat), so allowing them through is too
risky. But right
now what happens is that messages with winmail.dat
attachments are
silently quarantined, and we are getting an increasing
number of
complaints from both remote senders and local recipients
about their
mail not going through. Yes, the mail can be rescued from
the banned
attachments cache, but not all our users are active
Mailguard users, and
there is no notification that a message has been blocked. In
any case,
it has been determined that the status quo of silently
quarantining
these messages is unacceptable and, like it or not, I have
to do
something about it.

First, is anybody else seeing these winmail.dat attachments?
Surely it's
not just us? Anybody have a solution better than those we
are
considering that I describe below?

We are considering a number of options. I don't really want
to turn on
recipient notifications (which can be done in amavisd.conf)
because the
volume of such notices is overwhelming and everybody either
complains
about them or ignores them. Using amavisd is better than
what we used to
have because we could notify only for banned attachments,
but I still
think the volume of such notices will be a problem. 

It is possible to turn off the generation of the winmail.dat
attachment
in Outlook and in Exchange, but trying to coach remote users
to do this
has proved frustrating and unsatisfactory. We can't be the
e-mail client
consultant for everybody on the Internet who sends mail to
us.

I could hack amavisd-maia to send recipient notifications
only for
winmail.dat files, but that's both kludgy and hard to
maintain (any
future patches and updates would be more time consuming and
error prone
to apply). I could play some games with the banned filenames
map in
amavisd.conf to allow only winmail.dat attachments through
while
blocking other .dat files, but surely the attackers all know
about
winmail.dat by now, so this is too risky.

Other more creative ideas include modifications to the
database, to
amavisd-maia and to the PHP scripts that would allow users
to whitelist
senders solely for winmail.dat files, but that will be
extremely hard to
implement and maintain. Along the same lines, but much
easier although a
bit more risky, is to modify amavisd-maia so that
whitelisting a sender
also turns off banned attachment checks. That's the way I'm
leaning
right now; I wonder if such a feature would be generally
useful? To make
it generally useful would be more difficult because it would
require a
configuration option as to whether or not whitelisting would
include
banned attachment checks,  so that the default behavior of
the system is
not changed unless it is done explicitly.

Anybody else seeing this problem or have any other
thoughts?

Thank you,

--Greg

_______________________________________________
Maia-users mailing list
Maia-usersrenaissoft.com
http://www.renaissoft.com/mailman/listinfo/maia-users

winmail.dat attachments

Thread: winmail.dat attachments