SPE blocks Text and CSV files as application/x86-win-32-exe when FileTypeFilteringEnabled is enabled

Products

• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

The following problem scenario is occurring:

1. FileTypeFilteringEnabled is set to true, in filtering.xml
   
   
2. A .txt or .csv file whose first two characters begin with "NE" is submitted to be scanned by Symantec Protection Engine (SPE).
   
   
3. The file is rejected.
   
   
4. The SPE scanning logs contain the following key elements explaining why the file was rejected:
   
     Event:  A file attribute violation has been found
     Component name:  <FileName>.<extension>
     File Attribute:  File Attribute Violation = File Policy (Type)
     Violating Term:  application/x86-win-32-exe
   
   
5. If FileTypeFilteringEnabled mode is disabled, or if "application/x86-win-32-exe" is removed from the list of types to filter then SPE no longer rejects files of this composition when submitted.

Environment

Protection Engine 9.x, Stargate 8.x

Cause

A defect in the Stargate file typer incorrectly identifies files whose content begins with "NE" (which stands for "New Executable" and originates from the 16-bit Windows era) as being of the type "application/x86-win-32-exe".

Resolution

This will be addressed in a future release of Stargate.  

Currently the only workaround is to remove type "application/x86-win-32-exe" from the type filtering criteria. Otherwise know that files of this type will be rejected.