SurfControl E-mail Filter 6.0 for SMTP Readme

August 2007

Welcome

Welcome to SurfControl E-mail Filter 6.0 for SMTP. This release contains the enhancements and fixes listed below. If you have any technical questions about this release, please contact SurfControl Technical Support by phone or e-mail.

SurfControl E-mail Filter for SMTP messaging security software offers continuous protection against inbound and outbound threats. Easy to install and administer, the solution’s automatically updated databases, flexible policy setting and market-leading reporting combine best-in-class protection with exceptional visibility and control.

E-mail Filter 6.0 for SMTP delivers enhanced spam and virus protection through a number of exciting new features. These include integrated SurfControl reputation services, zero-hour virus protection and additional anti-virus scanning technology. In addition it provides improved compliance management through enhanced dictionaries, default rules and extended document decomposition. Extended environmental support for Windows Vista and VMware, also offers greater deployment flexibility.

New Features in SurfControl E-mail Filter 6.0 for SMTP

New Anti-Virus Engine Included with Standard Subscription

A fully integrated anti-virus scanning engine will now be available to customers as part of the dynamic threat database subscription, offering additional protection and value. The Anti-Virus Agent (AVA), powered by McAfee, will continue to be available as an additional cost option and can be used in conjunction with the new, integrated anti-virus engine.

Zero-Hour Virus Protection

This latest version of SurfControl E-mail Filter includes new Zero-Hour Virus Protection technology, protecting your network from viruses as they emerge.

SurfControl Reputation Service

Incoming e-mail connections can now be checked against SurfControl’s own Reputation Service to help determine whether the sender’s IP address can be trusted. This feature combines with the True Source IP feature to deliver increased protection and greatly reduce spam volumes to all SurfControl E-mail Filter customers.

Identification of True Source IP Address

Organizations choosing to deploy SurfControl E-mail Filter behind a firewall can now take full advantage of E-mail Filter’s Connection Management. The original source IP address of the inbound e-mail connection can now be identified, allowing all E-mail Filter users to benefit from this highly effective protection layer, including the additional security offered by the new SurfControl Reputation Service.

Enhanced Document Decomposition

This further extends the list of file types to which content filtering rules can be applied, including Microsoft Office 2007 documents, for deeper compliance and increased security and with the additional benefit of improved performance.

Extended Compliance Dictionaries and Default Rules Set

New compliance dictionaries and associated default rules, including HIPAA, GLBA and Personal Identifiers, will help you to manage regulatory compliance and enforce good corporate governance.

Compatible with SurfControl Report Central (SRC) 2.6

SurfControl E-mail Filter 6.0 enables you to take advantage of the enhanced reporting capabilities of SurfControl Report Central 2.6 such as a new Return on Investment (ROI) report, high-level inbound traffic summary chart and visibility of the new SurfControl Reputation Service, which is available in E-mail Filter 6.0.

Compatible with SurfControl Personal E-mail Manager (PEM)

SurfControl E-mail Filter 6.0 is compatible with both PEM 1.0 Service Pack 2 and PEM 1.2.

Support for VMware

This latest release of SurfControl E-mail Filter will be supported on a VMware platform, offering greater deployment flexibility and reduced total cost of ownership of security infrastructure.

Support for 64-bit Operating Systems

SurfControl E-mail Filter 6.0 is now supported on the 64-bit version of Windows Server 2003, giving customers greater flexibility and choice of platforms.

Bug Fixes

SurfControl E-mail Filter 6.0 for SMTP contains the following bug fixes:

Description

Issue Number

Defects Fixed in 6.0

Header Modification plug-in now has Return-Receipt-To.

2955

The value of the word ‘Vegas’ in the Gambling dictionary has been reduced from 30 to 10.

6361

Document Decomposition now extracts embedded images from Word documents.

9516

PDF attachments are now decomposed correctly.

12118

Administrators can now configure message parts for Message Administration.

13818

Certain Receive functions are now made available or unavailable for Trusted IP entries.

14053

There are now no performance issues in Rules Administrator or Message Administrator if Word files are attached to an e-mail.

14095

A Notices page now lists all relevant copyrights, notices and acknowledgements for 3rd-party software.

14271

PDFs attached to an e-mail do not now cause a bad file in Document Decomposition.

15260

Administrator can now specify subnet addresses in the Trusted IP list

15310

Document Decomposition now processes e-mails without performance issues.

15798

E-mail Filter tries secondary MX record or IP if the 220 banner is not received from the first host.

16113

Document Decomposition can handle large amounts of Japanese text.

17139

Administrators now have the ability to configure how sub-domains are treated.

17235

There is now LDAP support for Lotus Domino and Novell GroupWise.

18570

When using TLS, e-mails are not now delayed before they are sent to Qmail.

19391

Document Decomposition now handles attached MS Word files correctly.

20137

STEMConfig database is now backed up as part of the installation process.

20248

Scheduler logs now start new log file after reaching a size limit.

20574

SQL user name and password now not shown as clear text in the application log and Message Administrator Properties dialog box.

20683

Document Decomposition processes MS Word attachments correctly.

20723

Renamed STEMConfig and STEMLog databases can now be upgraded.

20977

Filenames of e-mail attachments that have been stripped are now included in the notification e-mail.

21461

LDAP Lookup now supports domain substitution.

21591

Added the ability to create passwords associated with domains rather than email addresses.

21901

*.bad messages are now created in the correct sub-folders.

24028

File Attachment rules object has been modified to correctly manage body parts of an e-mail.

24196

Can now add file extensions with more than five characters in the File Attachments rule object.

25155

Data in STEMLog that has not been copied by SRC can now be purged.

25390

ASA Heuristics does not now isolate the same number of spam e-mails if using Full Scan or Quick Scan

25456

Document Decomposition now decomposes file attachments correctly.

25562

The Threat Database Download Manager is used during upgrade to make the process faster.

25635

E-mail is now supported as a 32-bit application running on 64-bit hardware and operating systems.

25636

More support for compliance regulations.

25637

Improved technology to detect image spam.

25638

Addition of SurfControl Reputation service to the Receive service configuration.

25639

Document Decomposition supports MS Office 12 files.

25640

Installation Type screen options now refer to Server and Client.

25644

The Browse button is now enabled when the Rules Administrator is run on a client.

25645

Manually resending an e-mail in QueueView now increments the ‘attempt’ number.

25662

AutoQueue Management is not now disabled when the maximum number of managed queues has been exceeded.

25672

E-mail Filter upgrade does not now fail with an ADO error.

25731

Heuristics now works correctly.

25783

Upgrade and rollback processes have been improved.

25807

Receive logging in Receive console has been reverted to a previous style.

25809

The notification has been removed from the preconfigured ‘3rd Party Virus’ rule.

25810

Now no problem in deleting and releasing e-mails from Web Admin.

25839

Heuristics now uses From field in e-mail header correctly to identify e-mail spam.

25869

Heuristics now uses HTML UTF-8 byte select in field in e-mail header correctly to identify e-mail image spam.

25870

URL in the HTML body of an e-mail is now identified correctly.

25872

Internet Threat Database key does not now remain expired after the key has been renewed.

25964

Audit Log – From and To fields are now used correctly.

26020

Message Search can now find e-mail addresses that have apostrophes.

26021

’Find’ in Message Administrator can now find e-mail addresses that have apostrophes.

26022

Duplicate IP addresses in E-mail Filter do not now cause a failure of a database update in Report Central for E-mail Filter reports.

26222

Defaults for SQL scripts are now set for STEMConfig, STEMLog and STEMFriendlyName databases.

26354

Now no memory issues with the Receive service.

26358

Document Decomposition now decomposes MS Word files correctly.

26382

The clickable area for the Reverse Logic check box has been shortened to ensure that it is not selected or cleared by accident.

26387

Zero-hour Virus protection has been integrated into this release.

26433

Scheduled Queue Synchronization utility does not now change the time stamp.

26633

There are now options to retain the changes made to ‘Received’ drop-down list.

26634

Recovery mode is now set to ‘Simple’ on full SQL for STEMLog and STEMFriendlyName.

26635

Notifications for ‘bounced’ e-mails now have a null return path.

26667

E-mail Filter can now interrogate the e-mail envelope to determine the true originating sender information (True Source).

26845

For remote administration, the location of the messagehistory.html file has been changed so no errors are shown when opening Message History.

26937

Renamed RBL to DNS Blacklist.

27015

ScoutQueueAlert service and files are now removed after an upgrade from v5.2/v5.2.1

27075

Administrator alert thresholds now taken from ScoutQueueAlert.cfg during an upgrade from v5.2/v5.2.1

27076

Implemented a registry key for enabling pre-screening checks for Open Relay Trusted IPs.

27133

Removed various files from the VLA learning sample.

27167

Files mfc42.dll and mfc42u.dll do not now cause rules to hang.

27183

The Server Configuration tool > Receive Service > ESTMP Commands or Send Service > SMTP Properties > Transmission Optimizations > More Info file has been updated to match the style of the on-line Help.

27228

An acknowledgement, notice and copyright statement for OpenSSL has been added to the documentation.

27361

The properties for e-mails do not now show the number of attachments to be -1.

27614

RSA copyright notice has been added to the technical documentation.

27703

OddButton copyright notice has been added to technical documentation.

27705

Xerces copyright notice has been added to technical documentation.

27706

‘Independent’ is now spelt correctly in the ‘Properties for HTML Stripper’ dialog box.

28131

Known Issues

SurfControl E-mail Filter 6.0 for SMTP has the following known issues:

Description

Issue Number

Known Issues in 6.0

The status of an e-mail that is deleted in QueueView is not updated in the Message Search list; it continues to be marked as ‘Pending Delivery’.

24920

Column inconsistencies in Message Administrator when selecting Logs > Audit Logs

You can select two ‘Server’ columns when inserting columns into the display. Also, if you insert all columns, select another log, and then select the Audit Log again, most columns are not displayed.

25169

SEF can't use existing SQL Express database files from previous installation.

See Knowledge Base article 2017.

24458

Messages that should be isolated are not showing in the Message Administrator.

See Knowledge Base article 2022.

25362

E-mail Filter cannot detect a local SQL Server installed on a 64-bit system.

Workaround:

1. During installation, in the Configure Database screen you will be prompted to either:

     - Install SQL Express 2005 and create SurfControl E-mail Filter databases on this computer.

     or

     - Create SurfControl E-mail Filter databases on another computer.

2. Select the Create SurfControl E-mail Filter databases on another computer option, and then click Next.

3. In the Connect to SQL server screen, select (local) as the SQL Server instance. Select your authentication method, and then click Next.

4. Continue the installation as normal.

27169

No entries are created in the Data Sources (ODBC) - System DSN for any of the E-mail Filter databases (STEMConfig, STEMLog and STEMFriendlyName) for Windows Server 2003 64-bit edition.

See Knowledge Base article 2278.

28562

To be able to support Zero-Hour Virus Protection on a proxy server, you need to download a batch file from SurfControl.

See Knowledge Base article 2312.

29248

For more information, please refer to the SurfControl Knowledge Base. Contact SurfControl Technical Support for further assistance.

Upgrade Considerations

You can either install a full version SurfControl E-mail Filter 6.0, or you can upgrade from the following versions:

·         SurfControl E-mail Filter 5.2/5.2.1

·         SurfControl E-mail Filter 5.5/5.5 SP1

Note: Upgrade of the Administration Client installation is not supported. You will need to uninstall and re-install the Administration Client.

If you have upgraded to SurfControl E-mail Filter 6.0, you can uninstall this and ‘roll back’ to your previously installed version.

Please see the SurfControl E-mail Filter for SMTP 6.0 Starter Guide for upgrade, installation and rollback instructions.

Using SurfControl E-mail Filter 6.0 with Other SurfControl Products

To get the full benefit from SurfControl E-mail Filter 6.0 at no additional charge, you can also deploy SurfControl Personal E-mail Manager (PEM) 1.0 Service Pack 2 or SurfControl Personal E-mail Manager (PEM) 1.2, and SurfControl Report Central (SRC) 2.6. Please see the separate SRC 2.6 and PEM Readme documents for further details. To be able to create reports for SurfControl E-mail Filter 6.0, you need to upgrade to SRC 2.6 separately.

Using SRC 2.6, you can run a Return on Investment (ROI) report that details the cost savings on spam and viruses due to using SurfControl E-mail Filter 5.5/6.0.

Installation Requirements for PEM

You need to install E-mail Filter before installing PEM on a separate computer. E-mail Filter and PEM need to be installed on separate computers due to the increased need for system resources, which is caused by the new technologies.