We use cookies on our website to ensure we provide you with the best experience on our website. By using our website, you agree to the use of cookies for analytics and personalized content.This website uses cookies. More Information
Accept
It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Campus Barracuda Campus

Back to Knowledgebase

How can I block an email with copied RLO unicode character in it with my Email Security Gateway?

  • Type: Knowledgebase
  • Date changed: 9 months ago

Solution #00005857

 

Scope:

All Email Security Gateways, all firmware versions.

Answer:
To block the email with copied "RLO" (Right to Left Override) UNICODE that is attached with extension temp file, please block the following content filter "Header".

filename.*%E2%80%AE


Additional Notes:
Even if test[RLO]txt.exe is a EXE file, it will be shown as following TXT file, testexe.txt.

If this file is attached in the mail, mailer will encode the file name as the following.

filename*=UTF-8''%31%74%65%73%74%2E%E2%80%AE%74%78%74%2E%70%6E%67

"RLO? is the Unicode Character 'RIGHT-TO-LEFT OVERRIDE' (U+202E)?UTF-8 (hex)          0xE2 0x80 0xAE (e280ae)

So, part of "%E2%80%AE" is a RLO, so by creating a content filter for blocking this part, it will allow us to block the email.


Link to This Page:
https://campus.barracuda.com/solution/50160000000IgYnAAK