Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 60 replies
  • Subscribers 1 subscriber
  • Views 102189 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos 9's Buffer Overflow Protection System (BOPS) and Internet Explorer 8

JonKloske

Hi,

Just wondering if anyone else has noticed any odd behavior of Internet Explorer since upgrading from Sophos 7 to Sophos 9?

We've found that on a substantial portion of our machines (Windows XP, Windows Server 2003, and possibly even Windows 7) suffer from a reproducible but statistical-in-nature deadlock in Internet Explorer.

I originally reported the problem on Microsoft's Technet forums (http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/ef0a7af9-26b9-45b5-a05e-0cfd88c42aee) however it soon became clear that the culprit was Sophos_detoured.dll, part of the BOPS in Sophos 9 (and the timeline of the problem occurred very shortly after upgrading substantial portions of our machines to Sophos 9 from the original Sophos 7 clients they had installed.)

I notice someone else on the MS forums said they had the same problem, so I thought I'd post this here to achieve two things:

1. If other people experience this problem, they may know what's causing it instead of tearing their hair out about it

and

2. Perhaps other people have suggestions or advice

I should point out that we have an open ticket with Sophos about this at the moment [#2345512], and I've discovered at least two workarounds (which are both effectively the same workaround from different directions), so I'm not necessarily after assistance, just healthy discussion and information sharing.

As an aside, after I posted about this issue in a similar way on our internal forums, another IT staff member from a completely unrelated area responded along the lines of "Ahhh! That's what's causing it! We've just been reformatting and re-installing windows since we were stumped by the problems, and we never connected it with the recent upgrade to 9!"

And finally, the easiest workaround to the problem is to disable BOPS and reboot. There's a reghack that achieves effectively the same thing involving the AppInit_DLLs key (see the referenced microsoft forum post for details if you're brave.)

Cheers,

Jon.

:3208


This thread was automatically locked due to age.
Parents
  • 0

    Hi Lestat,

    Yes, the registry patch does the same thing as disabling "Detect buffer overflows" in the HIPS runtime behavior section of the clients.

    We updated our console policy to tell the clients to disable this, however as with most settings in the console we've had limited success with it on the clients: some of them update to the new policy (though technically it requires a reboot before it works fully), some of them don't.

    I tried adding iexplore.exe to the authorization manager but I don't think that actually stops the appinit_dlls key from containing that for internet explorer, merely that if IE does overflow it'll just let it continue (whereas this is a deadlock problem that's deeper than simply sophos' specific behavior.)

    Kind of a problem with the AppInit_DLLs key though is that it's hard to update properly, because other products (eg, google desktop search for example) also add entries here, so you can't just blanket blow it away on clients as it can cause other things to stop working.

    Anyway, Sophos is apparently unable to reproduce this problem on their test lab (though this is a common problem I encounter trying to get support for pretty much every piece of software I look after), so I've kind of gotten bored and moved onto my actual job (since I spent a month trying to get this and about 10 other issues sorted out and got largely nowhere with all but a couple of them where I managed to figure local workarounds out to like this one.)

    Cheers,

    Jon.

    :3484
Reply
  • 0

    Hi Lestat,

    Yes, the registry patch does the same thing as disabling "Detect buffer overflows" in the HIPS runtime behavior section of the clients.

    We updated our console policy to tell the clients to disable this, however as with most settings in the console we've had limited success with it on the clients: some of them update to the new policy (though technically it requires a reboot before it works fully), some of them don't.

    I tried adding iexplore.exe to the authorization manager but I don't think that actually stops the appinit_dlls key from containing that for internet explorer, merely that if IE does overflow it'll just let it continue (whereas this is a deadlock problem that's deeper than simply sophos' specific behavior.)

    Kind of a problem with the AppInit_DLLs key though is that it's hard to update properly, because other products (eg, google desktop search for example) also add entries here, so you can't just blanket blow it away on clients as it can cause other things to stop working.

    Anyway, Sophos is apparently unable to reproduce this problem on their test lab (though this is a common problem I encounter trying to get support for pretty much every piece of software I look after), so I've kind of gotten bored and moved onto my actual job (since I spent a month trying to get this and about 10 other issues sorted out and got largely nowhere with all but a couple of them where I managed to figure local workarounds out to like this one.)

    Cheers,

    Jon.

    :3484
Children
No Data