Attachments are blocked because they are detected as a different file-type

Versions / Builds Affected

2012/2014

Status

Resolved

Problem Summary

The MailEssentials Attachment Filtering blocks some emails with attachments because of a "File category mismatch (Claimed extension "xxx" - Claimed category "XXX" - Detected category "YYY")"

TT / JIRAID

400

How to Identify

MailEssentials would block emails with attachments because of a "File category mismatch". Checking the actual file would show that the file extension was not changed. Logs show: 2013-07-18,09:57:48,039,1,"#00001388","#00001378","info ","Attachment Checking","Full File Name = communication dc.doc" 2013-07-18,09:57:48,039,1,"#00001388","#00001378","info ","Attachment Checking","Content Type = application/msword" 2013-07-18,09:57:48,039,1,"#00001388","#00001378","info ","Attachment Checking","Content Class =" 2013-07-18,09:57:48,039,1,"#00001388","#00001378","info ","Attachment Checking","File Name No Ext = communication dc" 2013-07-18,09:57:48,039,1,"#00001388","#00001378","info ","Attachment Checking","File Extension = doc" 2013-07-18,09:57:48,039,1,"#00001388","#00001378","info ","Attachment Checking","File Type = 12 : []" ... 2013-07-18,09:57:48,039,1,"#00001388","#00001378","info ","Attachment Checking","Comparing detected (12) with claimed (11)." 2013-07-18,09:57:48,039,1,"#00001388","#00001378","info ","Attachment Checking","Short Error Report [Triggered rule "CONTENT POLICY: Block all potentially malicious attachments"]" 2013-07-18,09:57:48,039,1,"#00001388","#00001378","info ","Attachment Checking","Long Error Report [File category mismatch (Claimed extension "doc" - Claimed category "DOC" - Detected category "XLS")]"

Workaround / Fix Details

1. Upgrade to latest build 20140308 2. Locate the rule that triggered the mismatch 3. Adjust the options at the bottom of the rule to Extension only

Required Actions

1. Upgrade to latest build 20140308 or later 2. Locate the rule that triggered the mismatch 3. Adjust the options at the bottom of the rule to Extension only 4. Check the actual file and verify that the file ending was not changed. 5. If issue still persists get samples of the email in question and the mismatch reason and escalate the ticket.