MID xxxxxxx cannot be scanned by CASE. The message is either malformed or CASE is unable to process it at the moment.

[Jussi Torhonen]

Getting lots of critical error since 14 Dec 2017 from several of our Ironport ESAV appliances:

Critical: MID xxxxxxx cannot be scanned by CASE. The message is either malformed or CASE is unable to process it at the moment.

ESAV appliances are C300V and C600V. All running latest release v11.0.1-027. I have tried forcing CASE update (antispamupdate ironport force) but no help.

How can I get rid of this problem?

Regards,

Jussi

[Libin Varghese]

Hi,

I see quite a few instances of these errors were reported over the weekend and we are working on a fix on our end.

Regards,

Libin Varghese

[Jussi Torhonen]

It looks like 99% of all alerts are related to messages coming from lightinthebox.com or miniinthebox.com webshops. I have a CLI message filter logging From: and Reply-To: headers. It looks like all the problematic message events do have weird MIME encoding problems in the headers. I can see there headers like

From: Lightinthebox.com <system@email.lightinthebox.com>

From: "Miniinthebox.com"<Noreply-service@e.miniinthebox.com>

From: "Lightinthebox.com"<Noreply-service@lightinthebox.chtah.com>

Reply-To: "LightInTheBox.com"<support-xxxxxxxxxxxxxxxxxxx@lightinthebox.chtah.com>

So, perhaps you have tuned some CASE filtering workarounds against cisco-sa-20171129-esa / 

CSCvf44666, and they are causing some negative effects? I hope this helps you fixing problematic CASE rules soon.

Jussi

[Libin Varghese]

TALOS has incorporated updates to the CASE URL Database in an attempt alleviate the issues we have been encountering with messages from *inthebox.com.

This was done around 2:30am Pacific Time.

Are you seeing any improvements?

Regards,

Libin Varghese

[Jussi Torhonen]

Hello Libin

Currently last event that we have seen did happen 18 Dec at 09:37 UTC. It really looks like you got it fixed. Thanks!

Jussi

[Libin Varghese]

Good to hear that. We are seeing no more reports of these alerts.

There should be an updated anti-spam engine coming out soon too with further improvements.

Regards,

Libin Varghese