Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

BUG in email scanning, changes the wrong part of the email message

I have a number of email accounts which are scanned by the XG. The accounts are a mix of imap/s and pop3/s. I have an ssl based outlook account which does not get passed through the mail scanning policy.

The bug or bugs are

1/. the message is scanned and identified as not spam or unknown

2/. the message headers are not changed but the body of the message is changed

3/. the email logs show many imap/s messages received and the header re-written, I am talking about many 10s of messages when in reality there is one or two.

The following are examples of message body rewrites.

this is a mesage identified as spam on an imaps account, my daily XG report.

Please find the Executive Report statistics and graphs attached herewith.
X-CTCH-PVer:  0000001
X-CTCH-Spam:  Bulk
X-CTCH-VOD:  Unknown
X-CTCH-Flags:  0
X-CTCH-RefID:  str=0001.0A150205.56859F41.0056,ss=1,re=0.000,recu=0.000,reip=0.000,lb,cl=3,cld=1,fgs=0
X-CTCH-Score:  0.000
X-CTCH-ScoreCust:  0.000
X-CTCH-Rules:  
Subject: Spam scan :

Another where the message text is changed, but not identified as spam

X-CTCH-PVer: 0000001 X-CTCH-Spam: Unknown X-CTCH-VOD: Unknown X-CTCH-Flags: 0 X-CTCH-RefID: str01.0A150207.56859F2E.0072,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0 X-CTCH-Score: 0.000 X-CTCH-ScoreCust: 0.000 X-CTCH-Rules:

I have two different messages from this site. The message was identified as spam, but the other message which has it head changed is identified as spam.

X-CTCH-PVer: 0000001 X-CTCH-Spam: Unknown X-CTCH-VOD: Unknown X-CTCH-Flags: 0 X-CTCH-RefID: str=0001.0A150205.56861970.0081,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0 X-CTCH-Score: 0.000 X-CTCH-ScoreCust: 0.000 X-CTCH-Rules:

From what I can see the body of the message of emails with a spam classification of "unknown" are being incorrectly changed. The messages actually identified as spam are only having their headers changed.



This thread was automatically locked due to age.
Parents Reply
  • Hi Luk,
    I saw that thread, but don't use XG to scan my iphone email and I advised I would create a seperate thread in you pop3 scanning failure thread.

    Ian,

    home UTM 9.x running in ESXi 6 e3-1275v2

    AP55c and AP10 (courtesy Astaro)

    Three other UTMs, SUM and SFM in hibernation

    XG 15.x MR3 in hibernation

Children
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?