Are .eml attachments a security risk?

Question

My email service provider blocks mails with attached .eml files, apparently for security reasons, with the result that I loose relevant mails.

I have tried to find a description of the current security risk of forwarding mails with .eml files attached, but I could only find posts about 10 years old about vulnerability in Outlook.

What are the current risk of mails with .eml attachments, and is blocking by an email service provided still relevant ?

Solution 1

What are the current risk of mails with .eml attachments ?

Risks described in this post are still the risks with mails with .eml attachments because of old IFrame exploits, MIME exploits and viruses like Nimda

In some email clients, such as Microsoft Outlook, .eml files can trigger active scripting that can be used to launch virus activity. Furthermore, other executable file types can be wrapped in .eml files in order to bypass other virus checking scans. Therefore, many ISPs and email servers block the .eml file type.

Is blocking by email service provider still relevant ?

This is debatable topic.

But if service provider wants to take the ownership of filtering emails for you, they must provide you with a quarantine zone where you can check what emails are blocked and if you want them to be delivered or not

Solution 2

The Nimda virus is known to create EML files. When EML files are found as an included attachment it is good practice to scan with anti virus before opening.

Comments

[Johannes Tue]

I would contact that service provider and say them that it's not their business to block any email.

[EquipDev]

I tried that, but they said that filtering in general helps a lot for their other users, and that the filtering is server wide, so now I try to figure out if this filter is actually required, or I can go back to them and say that they can remove it...

[Moab]

They should be able to remove attachment filtering on your account only, if they say they cannot try another email provider.