Messages with large attachments are deadlettered

This article applies to:

• Trustwave MailMarshal (SEG)
  • Note: Default values are changed at release 7.3.0.
  • Note: Minor issue corrected at release 7.2.1
• Trustwave ECM/MailMarshal Exchange 7.X

Symptoms:

• Deadletter: Message unpacks to more than xxx files
• Deadletter: Message unpacks to more than xxx bytes
• Deadletter: Message unpacks to more than xxx times its size of xxx bytes
• Deadletter: Massively redundant data detected in filename.zip

Causes:

MailMarshal performs a number of checks on messages it receives to ensure that attackers cannot send specially-crafted attachments that cause relatively small compressed files to expand into enormous proportions. Sometimes, these checks can cause legitimate emails to be deadlettered, such as in the case of heavily compressed software log files.

MailMarshal performs these tests using default values that Trustwave has selected as suitable for most installations. However, if you are consistently encountering problems with good email, you can change the values used by adding Registry entries.

Resolution:

Each of the keys below are DWORD values, and should be added on the Array Manager or in the Management Console:

1. On the Array Manager, edit the Registry (10.X: use Advanced Settings in the Management Console)
2. Navigate to the SEG Engine key:
   • In SEG version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
   • MailMarshal (SEG) 10.X: value names have the prefix Engine. (Engine dot).
   • For full details of the location for each product version, see article Q10832.

Note: When you enter values, select decimal entry.

• The maximum value available is 2 147 483 647 (Decimal). Larger values can be entered in the Registry but will not be correctly interpreted.

Once the value is entered, commit the configuration changes. You may also need to restart the Engine service on each processing server.

Default values:

• "MaxNumUnpackedFiles" (default: 40000)
• "MaxSizeUnpackedFiles" (default: 1000000000 [1 GB]; maximum: 2147483647)
• "SuspiciousCompression" (default: 100)
• "SuspiciousCompressionMinSize" (default: 5)
• "SuspiciousSize" (default: 100000000 [100 megabytes]; maximum: 2147483647)

Explanation of behaviors:

"Message unpacks to more than xxx files"

If the total number of files unpacked is greater than the MaxNumUnpackedFiles threshold set in the registry, SEG or ECM deadletters the message.

if (TotalNumUnpackedFiles > MaxNumUnpackedFiles) then Deadletter Message




"Message unpacks to more than xxx bytes"

If the message unpacks to more than the MaxSizeUnpackedFiles threshold set in the registry, SEG or ECM deadletters the message.

if (TotalSizeUnpackedFiles > MaxSizeUnpackedFiles) then Deadletter Message

"Message unpacks to more than xxx times its size of xxx bytes"

If the total size of the all files unpacked from a message exceeds the original message size multiplied by the SuspiciousCompression ratio, and if the total size of all files unpacked from a message is larger than the minimum size threshold (MaxSizeUnpackedFiles) divided by the SuspiciousCompressionMinSize ratio then SEG or ECM deadletters the message.

if (Minimum Size Threshold && Suspicious Compression Threshold) then Deadletter Message


Minimum File Threshold == (TotalSizeUnpackedFiles > MaxSizeUnpackedFiles / SuspiciousCompressionMinSize)
Suspicious Compression Threshold == (TotalSizeUnpackedFiles > OriginalMessageSize * SuspiciousCompression)

"Massively redundant data detected in filename.zip" (note: specific to zip files)

If uncompressed size divided by compressed size is greater than the SuspiciousCompression ratio set in the registry, and the uncompressed size is greater than the SuspiciousSize threshold ratio then SEG or ECM deadletters the message.

if (Suspicious Size Threshold && Suspicious Compression Threshold) then Deadletter Message


Suspicious Size Threshold == TotalUncompressedSize > SuspiciousSize
Suspicious Compression Threshold == TotalUncompressedSize / TotalCompressedSize > SuspiciousCompression

Notes:

• As always, take due care when editing the Registry. Trustwave recommends you back up the Registry and SEG or ECM configuration before making any changes.
• In MailMarshal SMTP versions below 7.3, the default values are:
  • "MaxNumUnpackedFiles" (default: 10000)
  • "MaxSizeUnpackedFiles" (default: 500000000 [500 megabytes]; maximum: 2147483647)
  • "SuspiciousCompression" (default: 20)
  • "SuspiciousCompressionMinSize" (default: 5)
  • "SuspiciousSize" (default: 100000000 [100 megabytes]; maximum: 2147483647)
• In MailMarshal SMTP versions 7.2.0 and below, due to a computation error incorrect results will be returned for some files when using the default values for file size and compresed size. This issue is corrected in MailMarshal SEG 7.2.1.
  • This issue also affects MailMarshal Exchange current releases.