ESA: Scanning error: (attachment) not readable

[Hallowelt]

Dear all,

from time to time we're observing scanning errors, mostly with ms office documents. Error message is

Info: MID 123456789 attachment 'XXXXXX.docx'
Info: MID 123456789 was marked unscannable due to extraction failures. Reason: Error in extraction process.
Warning: MID 123456789: scanning error (name='XXXXXX.docx', type=document/doc): not readable

Sadly I can't recreate this behaviour. 

Any Idea, why some attachments create this kind of error?

System Information: 

Name: C695
Product: Cisco C695 Email Security Appliance
Model: C695
Version: 14.2.1-020

Thanks,
Harald

[Ken Stieers]

If is always docx, grab the doc that errored and rename it to zip and then unzip it. If it has over 200 items in it, it will fail extraction.

It should show up in one of thw logs that this is the issue.

[Hallowelt]

Hi Ken,

thanks for your hint.

unfortunately I've no access to the problematic files, but
will try to create a test docx.

Kind regards,

Harald

[Hallowelt]

Hi Ken,

tried with a docx test document containing 304 files and can't provoke the error with it. 

Error message is always

Fri May 26 10:18:53 2023 Info: PF: MID XXXXXXXX Failed to open document - 'XXXXXX.docx' because it is not readable.

Any idea what "not readable" in this context means. 

Thanks,

Harald

[pascaldumas]

same problem for me yesterday ! I am able to rename the file and unzip it with no problem.

[Hallowelt]

Dear all,

this seems to be the this - currently open - bug.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwf24244

I guess, at least 14.2.1-020 can be added to the affected releases. 

Kind regards,
Harald