Messages that trigger MIME warning get unscannable verdict

Products

• Messaging Gateway

Issue/Introduction

Some messages that appear to contain proper MIME headers trigger Mime warning and get unscannable verdict.


Symptoms
You notice that some messages that seem to contain proper MIME headers are getting unscannable verdict. You see "Decomposition has found a questionable container" log entry at NOTICE level in bmserver_log. You also see "Mime warning MIME_WARNING..." log entry at DEBUG level or bmserver_log.

 

Cause

This behavior is by design. A close examination of the MIME headers in the message will reveal that the MIME headers are indeed malformed and not RFC complaint.

Resolution

With default configuration, the AntiVirus scanning engine looks at the content more aggressively for any signs of malformed MIME. This can cause the scanning engine to render unscannable verdict if it encounters any malformed MIME headers in the message.

WORKAROUND:
A workaround is available to mitigate this issue by forcing lenient evaluation of MIME headers. Please contact Symantec Technical Support for assistance with the workaround.