Issue with MTA and Threat Emulation Engine Release - Password Protected Archives Not Being Blocked

[SubZer0]

I have detected an issue with MTA and Threat Emulation. Password-protected archive attachments are no longer being blocked as expected.During debugging, I noticed that running cat $FWDIR/teCurrentPack/te_ver.ini returns version 60.990002419. However, according to sk95235, the latest available version should be 60.990002351.

It appears that the installed engine version is higher than what is officially listed, and this might be related to the failure in blocking encrypted archives.

[Chris_Atkinson]

Are you saying malicious archives aren't being blocked or are you expecting _all_ password protected archives to be blocked - what is your configuration?

Please raise a case with TAC to investigate as appropriate.

[SubZer0]

All password protected archives to be blocked.

[Chris_Atkinson]

Make sure you share the following outputs with TAC:

[Expert@HostName:0]# tecli advance archive show

[Expert@HostName:0]# tecli advance error show

[SubZer0]

tecli advance archive show

Encrypted archives feature is: enabled

tecli advance error show

file_max_size error File exceeds size limit
archive_max_files error Max number of files in archive reached
archive_pass_protected fail_close Password protected archives cannot be emulated
archive_extraction error Archive extraction error
doc_pass_protected continue Password protected document
archive_mime_type_mismatch continue Extension indicates an archive, but MIME type is unsupported.
unsupported_file_type error Unsupported file type
archive_max_decompression_rate_limit fail_close Max decompression rate limit reached in archive, file is suspected to be an archive bomb.
file_type_mismatch continue Extension indicates a specific file type, but MIME type shows a different type.

[the_rock]

Definitely do share what Chris gave. I recall TAC asking for those before.

[Chris_Atkinson · Accepted solution]

If you already have the necessary config per sk112821 please open a TAC SR and share the details so I can loop in the necessary folk.

[SubZer0]

The system was working fine, but it stopped working suddenly without any changes being made. I’ve already applied the settings according to sk112821, but it’s still not working.

[the_rock]

Definitely open TAC case then, as Chris suggested.

[the_rock]

Hey mate,

Please keep us posted how this gets solved. Had customer today ask me something very similar.

[SubZer0]

TAC case was send to R&D engineer.

[the_rock]

Hey mate,

I would just follow what Chris suggested, he isa excellent. Im sure he will assist you offline with this if needed.