000035108 - RSA Security Analytics is unable to unzip reconstructed zip files when "Content-Transfer-Encoding: base64" is before the MIME-version in the header

Document created by RSA Customer Support Employee on May 12, 2017
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000035108
Applies ToRSA Product Set: Security Analytics, NetWitness Logs and Packets
RSA Product/Service Type: User Interface, Investigation
RSA Version/Condition: 10.6.0, 10.6.1, 10.6.2, 10.6.3
 
IssueWhen you attempt to open a base64 encoded content file that has been reconstructed by RSA Security Analytics and is unzipped; you may not be able to see the content.
CauseDuring file reconstruction RSA Security Analytics may not be able to pull the MIME-version because it has not yet extracted the "Content-Transfer-Encoding".
RSA Security Analytics first looks for the MIME-version in the buffer.  If the "Content-Transfer-Encoding" is equal to base64 and the MIME-version is listed after the "Content-Transfer-Encoding" then it views the data incorrectly.
ResolutionThis issue will be resolved in RSA Security Analytics 10.6.4.

Attachments

    Outcomes