Messages with large attachments are deadlettered

This article applies to:

• MailMarshal (SEG)
  • Note: Default values have changed from earlier releases.
• MailMarshal ECM/MailMarshal Exchange 7.X

Symptoms:

• Deadletter: Message unpacks to more than xxx files
• Deadletter: Message unpacks to more than xxx bytes
• Deadletter: Message unpacks to more than xxx times its size of xxx bytes
• Deadletter: Massively redundant data detected in filename.zip

Causes:

MailMarshal performs a number of checks on messages it receives to ensure that attackers cannot send specially-crafted attachments that cause relatively small compressed files to expand into enormous proportions. Sometimes, these checks can cause legitimate emails to be deadlettered, such as in the case of heavily compressed software log files.

MailMarshal performs these tests using default values that LevelBlue has selected as suitable for most installations. However, if you are consistently encountering problems with good email, you can change the values used by adding Registry entries.

Resolution:

Each of the keys below are Integer or DWORD values, and should be added on the Array Manager or in the Management Console:

• In MailMarshal 10.0 and above, open the Management Console and navigate to Advanced Settings. Add or edit one or more of these values:
  • Value names:
    • Engine.MaxNumUnpackedFiles
    • Engine.MaxSizeUnpackedFiles
    • Engine.SuspiciousCompression
    • Engine.SuspiciousCompressionMinSize
    • Engine.SuspiciousSize
  • Type: Integer
  • Value: The required value
• In MailMarshal 8.X and below, and ECM, open the Registry Editor on the Array Manager. Within the base registry key, navigate to \Default\Engine
  • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
  • For information about the registry location for each version, see article Q10832.
  • Enter each required value as a new DWORD value. Use Decimal numbers to avoid confusion.
  • Value names:
    • MaxNumUnpackedFiles
    • MaxSizeUnpackedFiles
    • SuspiciousCompression
    • SuspiciousCompressionMinSize
    • SuspiciousSize
• Save your registry settings or configuration settings.
• Commit the configuration changes and restart the MailMarshal Engine service on each node.

Note: When you enter values in the Registry, select decimal entry.

Default values:

• "MaxNumUnpackedFiles" (default: 40000)
• "MaxSizeUnpackedFiles" (default: 1000000000 [1 GB]; maximum: 2147483647)
• "SuspiciousCompression" (default: 100)
• "SuspiciousCompressionMinSize" (default: 5)
• "SuspiciousSize" (default: 100000000 [100 megabytes]; maximum: 2147483647)

Explanation of behaviors:

"Message unpacks to more than xxx files"

• If the total number of files unpacked is greater than the MaxNumUnpackedFiles threshold set in the registry, MailMarshal or ECM deadletters the message.
• if (TotalNumUnpackedFiles > MaxNumUnpackedFiles) then Deadletter Message

"Message unpacks to more than xxx bytes"

• If the message unpacks to more than the MaxSizeUnpackedFiles threshold set in the registry, MailMarshal or ECM deadletters the message.
• if (TotalSizeUnpackedFiles > MaxSizeUnpackedFiles) then Deadletter Message

"Message unpacks to more than xxx times its size of xxx bytes"

• If the total size of all files unpacked from a message exceeds the original message size multiplied by the SuspiciousCompression ratio, and if the total size of all files unpacked from a message is larger than the minimum size threshold (MaxSizeUnpackedFiles) divided by the SuspiciousCompressionMinSize ratio then MailMarshal or ECM deadletters the message.
• if (Minimum Size Threshold && Suspicious Compression Threshold) then Deadletter Message

Minimum File Threshold == (TotalSizeUnpackedFiles > MaxSizeUnpackedFiles / SuspiciousCompressionMinSize)
Suspicious Compression Threshold == (TotalSizeUnpackedFiles > OriginalMessageSize * SuspiciousCompression)

"Massively redundant data detected in filename.zip" (note: specific to zip files)

• If uncompressed size divided by compressed size is greater than the SuspiciousCompression ratio set in the registry, and the uncompressed size is greater than the SuspiciousSize threshold ratio then MailMarshal or ECM deadletters the message.
• if (Suspicious Size Threshold && Suspicious Compression Threshold) then Deadletter Message

Suspicious Size Threshold == TotalUncompressedSize > SuspiciousSize
Suspicious Compression Threshold == TotalUncompressedSize / TotalCompressedSize > SuspiciousCompression

Notes:

• As always, take due care when editing the Registry. LevelBlue recommends you back up the Registry and MailMarshal or ECM configuration before making any changes.