This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

'ROP' exploit prevented in Microsoft

Hayim Caspy over 6 years ago

Hi All

I keep getting this error in all computers that have office 2013.

Excluding intercept x resolve the problem.

But I do want intercept x to work.

No exclusion (details exclude...) works.

This thread was automatically locked due to age.

Stephen Nix1 over 6 years ago

Experiencing the same thing.
Cancel
Vote Up 0 Vote Down

Cancel
Josh Clark over 6 years ago

I'm having the same issues as well.
Cancel
Vote Up 0 Vote Down

Cancel
Will Schwarz over 6 years ago

I would also like to add that I am receiving the same error and cannot open Outlook. So far only 1 user is affected. Please advise.
Cancel
Vote Up 0 Vote Down

Cancel
Andrew Graham over 6 years ago

I have a customer with the same thing. started today AEST @ 10:19:23 AM

only one customer at that site out of 15

I have tried to allowing it via the portal

still keeps blocking it

i have done the log PROCMON

but need credentials to your FTP site to upload as it is greater than 30MB
Cancel
Vote Up 0 Vote Down

Cancel
Sergei Gritsenko over 6 years ago

Today at around 10:51AM (PDT) I got the same issue with my Microsoft Office Outlook 2013.

Looks like there are quite a few people having the same issue. Please advise.
Cancel
Vote Up 0 Vote Down

Cancel
Adithyan Thangaraj over 6 years ago

Hi All,

Our apologies for the inconvenience. This issue is identified by development and are actively investigating on the same. Moredetails are given in this advisory. Currently a work around is provided, however, a permanent solution shall be arrived at as soon as possible. This issue is witnessed on endpoints running newer version of Intercept X/Exploit prevention and also updated with the latest Windows update made available on October 18 2018.
Cancel
Vote Up 0 Vote Down

Cancel
Edward Aspden over 6 years ago

Experiencing the same error except on Office 2016 on Windows 10 64bit across all office programs, safemode has no effect. Unable to use any office programs, currently only on one machine but there are pending sophos program updates to install upon reboot. We do not want this behavior to be present on any other machines.
Cancel
Vote Up 0 Vote Down

Cancel
Hayim Caspy over 6 years ago in reply to Edward Aspden

Check the workaround sophos suggested

https://community.sophos.com/kb/en-us/132953
Cancel
Vote Up 0 Vote Down

Cancel
Hermann Huber over 6 years ago

The mentioned workaround has fixed it for Outlook 2013. But Skype for Business 2013 is still blocked by Sophos because of the ROP exploit.
Cancel
Vote Up 0 Vote Down

Cancel
Adithyan Thangaraj over 6 years ago in reply to Andrew Graham

Hi Andrew,

Apologies for the delay. Please DM me your case number and I shall fetch you the FTP details to upload the logs ASAP.
Cancel
Vote Up 0 Vote Down

Cancel