Messaging Server: Using UBE feature to filter email bodies or enclosures

Question

Using the UBE feature in Messaging Server to filter email bodies or enclosures
<P>
Messaging Server has a feature for filtering unsolicted bulk email(UBE) based
on the envelope information (e.g., the sender's host name ). When the
Parse Headers option is enabled,
filtering by header information (e.g., the subject line of the email) is
performed as well.
<P>
The UBE feature is a plug-in that is designed to work with structured header
lines. However, the application of this feature to email bodies is limited.
To filter email bodies, the RUN
action can be used to send a selected
email to an external program, such as VirusScan.exe
. For more information on the
RUN action, see the Netscape
Messaging Server 3.5 Administrator's Guide at<BR>
<P>
http://docs.iplanet.com/docs/manuals/messaging/nms35/ag/ch5.htm#actions
<B>RUN</B><BR>
<P>
Argument:<BR>
A command line to execute.
<P>
Description:<BR>
The RUN action provides
a means of extending the filtering actions of the UBE filter by running another
program. The program must be in the postoffice (spool) directory for security
reasons. After executing the program, the UBE filter pipes the header and the
body of the email to the program for processing. In addition, you can use the
special field name $& in
subsequent filters to match the return value of the program. For example,<BR>
<P>
Subject "May contain a virus" RUN "VirusScan.exe"
$& "1" REJECT "This had a virus"
<P>
If there is an email with the subject line "May contain a virus," the filter
will run the virus program VirusScan.exe
and send the entire email to this
program. If the return value from the virus program is "1," then the filter
will reject the email with the reason "This had a virus
Several customers have reported problems with the UBE feature failing to
filter emails using the Content-Type
or Content-Disposition
lines. The reason why the UBE feature
fails with these lines is because they are header style lines that appear in
the email bodies as part of the MIME formatted body. The UBE feature does not
filter emails using these header lines, as it checks only the envelope and
header fields. To target the Content-Type
or Content-Disposition
lines, use the RUN
action with a reference to an
external program. The following lines are examples of header style lines that
can be targetted with a RUN
UBE command:<BR>
<P>
Content-Type: application/octet-stream;^M
name="LOVE-LETTER-FOR-YOU.TXT.vbs"^M
Content-Transfer-Encoding: quoted-printable^M
Content-Disposition: attachment;^M
filename="LOVE-LETTER-FOR-YOU.TXT.vbs"^M
<P>
<B>Please note:</B><BR>
<P>
Messaging Server 4.0 does not support the RUN
action in the implementation of
the UBE feature. This change is also documented in the release notes for all
subsequent releases of Messaging Server.
<P>
For more information on using UBE filters, please see technote 20000506-1,
"I Love You" Virus, article 4355.

Answer 1

RUN is also not available in NMS 4.15 or any NMS 4.x version.
You can however integrate a virus scanner into iMS 5.1 via the conversion channel.
If upgrading is not an option you should consider using a virus scanner that masquerades as a smtp server and forwards scanned messages to the real server.
-Chris