Solution #00005857
Scope:
All Barracuda Spam Firewalls, all firmware versions.Answer:
To block the email with copied "RLO" (Right to Left Override) UNICODE that is attached with extension temp file, please block the following content filter "Header".
filename.*%E2%80%AE
Additional Notes:
Even if test[RLO]txt.exe is a EXE file, it will be shown as following TXT file, testexe.txt.
If this file is attached in the mail, mailer will encode the file name as the following.
filename*=UTF-8''%31%74%65%73%74%2E%E2%80%AE%74%78%74%2E%70%6E%67
"RLO” is the Unicode Character 'RIGHT-TO-LEFT OVERRIDE' (U+202E) UTF-8 (hex) 0xE2 0x80 0xAE (e280ae)
So, part of "%E2%80%AE" is a RLO, so by creating a content filter for blocking this part, it will allow us to block the email.
Link to This Page:
https://campus.barracuda.com/solution/50160000000IgYnAAK