Threat defense scanning fails for attachments with extended characters in name

book

Article ID: 171251

calendar_today

Updated On:

Products

Messaging Gateway

Issue/Introduction

Threat defense scanning for some message attachments fails with an error indicating that no file has been uploaded to CAS for scanning. This results in an Unscannable verdict. Depending on policy this may results in the message being quarntined or deleted.

Reviewing Message Audit Logs (MAL) shows that the attachment file name contains extended characters. For example:

Attachment Name			档案的验收与移交\r\n\r\n\r\n\r\n\r\n\r\n.xls
casoop: error parsing http post response:
{"api_version":1,"exec_time":0.008196999999999999,"request":"POST
/rapi/cas/scan","result":{"error":"No file
uploaded","status":2},"server_time":"2018-02-25T16:46:20.600098"}

Cause

The extended characters in the filename creates a mismatch between the filename that CAS is scanning and the filename SMG uses when querying CAS for scan status.

Resolution

This is a known issue with SMG 10.6.4 and earlier but will be addressed with the SMG 10.6.5 release.