It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Campus Barracuda Campus

Back to Knowledgebase

How can I block an email with copied RLO unicode character in it with my Email Security Gateway?

  • Type: Knowledgebase
  • Date changed: one year ago

Solution #00005857

 

Scope:

All Email Security Gateways, all firmware versions.

Answer:
To block the email with copied "RLO" (Right to Left Override) UNICODE that is attached with extension temp file, please block the following content filter "Header".

filename.*%E2%80%AE


Additional Notes:
Even if test[RLO]txt.exe is a EXE file, it will be shown as following TXT file, testexe.txt.

If this file is attached in the mail, mailer will encode the file name as the following.

filename*=UTF-8''%31%74%65%73%74%2E%E2%80%AE%74%78%74%2E%70%6E%67

"RLO? is the Unicode Character 'RIGHT-TO-LEFT OVERRIDE' (U+202E)?UTF-8 (hex)          0xE2 0x80 0xAE (e280ae)

So, part of "%E2%80%AE" is a RLO, so by creating a content filter for blocking this part, it will allow us to block the email.


Link to This Page:
https://campus.barracuda.com/solution/50160000000IgYnAAK