136623 - Big problem with Virus Scanners and mozilla mailboxes

Status: VERIFIED DUPLICATE of bug 116443

(MailNews Core :: Database, defect)

Description

[Marcin Orlowski]

Frankly it's not a but. Neither mozilla's nor antivirus', it's rather a way of
work and but it affects mozilla badly, and only here it could be worked out. 

The problem appears if user uses mozilla's mailer and POP3 account (and probably
offline IMAP folders as well) and got any antivirus software active in system
and it's configured to scan written files agains viruses. Since mozilla fetches
all new mails directly into mailbox file, antivirus scans it on write, detects a
worm and acts. Even user got it configured to act interactively, there's a very
high risk he wipe out infected file accidentaly, without reading which file (if
antivirus shows that information in the readable form) in fact he will be
punishing. And this means the whole mailbox (i.e. Inbox) get deleted.

This could be easily worked out by fetching mails into temporary files first,
and then merge it into mailbox file. Even it would affect the performance, it'd
safe some innocent mailboxes from being slashed.

Comment 1

[Vadim Berezniker]

Mozilla uses the standard mbox format for storing emails.

I remember this issue was beat to death on the newsgroups.

It's the anti-virus' fault.

Comment 2

[Marcin Orlowski]

What's antivirus fault? That it works the way you configured it?

Comment 3

[R.K.Aa.]

This scenario spawned bug 116443 - resolving as dup. See discussion there.

*** This bug has been marked as a duplicate of 116443 ***

Comment 4

[Gayatri Rimola]

Verified that this bug is a duplicate of bug 116443

Comment 5

[Ben Bucksch (:BenB)]

> What's antivirus fault?

That it obviously can detect virii in emails (attachments have a special
encoding), but cannot deal with mbox, which is a standard and very common format.

Please see the newsgroup thread about it.

Comment 6

[Ben Bucksch (:BenB)]

oh, which antivirus packages did you test? (please comment on the dup bug)

Comment 7

[Marcin Orlowski]

I'd bet it can't deal with lot of "standard", but it's NOT designed
to deal with mbox but to deal with viruses, which as we see, is
managed well. Understand the differece.

Comment 8

[Ben Bucksch (:BenB)]

to detect the virus at asll, it has to *decode* the email to some extend
anyways. This *partial* support for email (standards) is what causes this.

Comment 9

[Marcin Orlowski]

MIME or UUE is not email-related only (even it's mostly used there). Good if AV
can handle these, but I'd get damn angry if AV could mess my mbox file! God
damn, it's mailer's task to do so. The point is that using just temp file would
solve this.

BTW: I assume you'd be in heaven when doing full disk scan you'd find you
mailboxes modified (in good faith of course) by AV whenever virus could be found
there? FYI: I got a folder where I keep plenty of them for my own purposes and I
want them to stay no matter what's AV thinks of it.