When the "AllowMalformedContainerTypes" registry key is activated on a Windows Server that runs Symantec Mail Security for Microsoft Exchange it causes read/delivery receipts to be quarantined.

book

Article ID: 156134

calendar_today

Updated On:

Products

Mail Security for Microsoft Exchange

Issue/Introduction

Having followed TechNote "How to allow malformed containers with Symantec Mail Security for Microsoft Exchange (SMSMSE) 6.5.5 or later" to add "AllowMalformedContainerTypes" to the registry avoid unscannable verdict on certain file types like PDF, an unscannable verdict is triggered on message read/delivery receipts. 

Sample unscannable errors on Windows Application log:

 
--------------------------------------------------------------
Log Name:      Application
Source:        Symantec Mail Security for Microsoft Exchange
Date:          12/01/2012 11:32:02 AM
Event ID:      218
Task Category: Unscannable
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      Ex2k7.sample.local
Description:
The attachment "Message Headers" located in message with subject "Successful 
Mail Delivery Report", located in SMTP has violated the following policy 
settings:
Scan: Auto-Protect
Rule: Unscannable File Rule
The following actions were taken on it:
The attachment "Message Headers" was Quarantined for the following 
reason(s):
Scan Engine Error.  CSAPI DEC result: 0xA. A malformed container is detected.
------------------------------------------------------------
Log Name:      Application
Source:        Symantec Mail Security for Microsoft Exchange
Date:          12/01/2012 11:32:33 AM
Event ID:      218
Task Category: Unscannable
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      Ex2k7.sample.local
Description:
The attachment "MDNPart3.txt" located in message with subject "Return Receipt 
(displayed) - test", located in SMTP has violated the following policy 
settings: Scan: Auto-Protect
Rule: Unscannable File Rule
The following actions were taken on it:
The attachment "MDNPart3.txt" was Quarantined for the following 
reason(s):
Scan Engine Error.  CSAPI DEC result: 0xA. A malformed container is detected.
--------------------------------------------------------

Cause

When the read/delivery receipt is finally delivered to the end users mailbox, it appears to change depending on the system. But what is consistent on all platforms is that the "text/RFC822-Headers" message body part triggers unscannable verdict on SMSMSE after the "AllowMalformedContainerTypes" is added to the registry.

 

Resolution

The issue has been fixed on version 6.5.8. Upgrade to version 6.5.8 or higher to resolve the issue.


Applies To

Exchange 2007 on Windows 2008 SP2

SMSMSE 6.5.6

Attachments