SOLVED: Sophie not detecting some viruses

Hello,

I have managed to find why Sophie lets some viruses through.

This actually seems to be a problem with MIME handling in some versions
of Amavis, maybe Sophie, and/or SAVI itself.

The messages that pass undetected are bounces. If a mail containing
virus is sent to some server that rejects it, the originating mail
server produces a bounce, appends whole original contents (with virus)
and sends it to original sender.

The bounces are often _not_ MIME messages - for example those generated
by Exim 3. Instead, body of the bounce _is_ MIME-encoded (it has an
attachment with virus).

The problem is that neither Amavis nor SAVI bothers decapsulating MIME
contents from messages that doesn't have MIME headers in the first
portion of headers (the proper headers of the message). The problem is
that Outlook decapsulates this MIME content and luser is able to
doubleclick the file and run virus.

I've prepared a message with virus and passed it to sock.pl. The result
was "CLEAN". Then I removed first portion of headers and the body
informing about the reason of bouncing. This way I've got original
e-mail. I ran sock.pl again - this time result was "INFECTED".

I can send you the two files if you can (in password-protected ZIP), I
just don't want to post it to the public mailing list...

I don't know whether Sophie has the ability to decapsulate the MIME
parts, or it is done by SAVI. Actually I don't know why Amavis haven't
done decapsulation by itself when compiled with Sophie, because it works
perfectly with SWEEP - I mean it splits the message into pieces and runs
SWEEP over them.

My config is Amavis 0.3.12, Sophie 3.04rc2, Sophos 3.77.


Regards,
Andrzej Kukula