Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 8 replies
  • Subscribers 30 subscribers
  • Views 3677 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Constant IPS Alerts for July Windows Updates (KB4558998)

haydenspence

Hello.

I'm posting this here to see if anyone else is experiencing this issue, and if it is possible to identify what exactly is going on with IPS on my XG Firewall.

It appears that with the most recent Windows Updates (KB4558998), when the update download reaches 99% in the Settings app, there are a huge number of IPS alerts generated (one of my firewall rules is scanning this particular traffic from all servers on my network to the Internet).

Here are the threats which are being detected:

BROWSER-IE Microsoft Edge App-v vbs Command

BROWSER-IE Microsoft Edge App-v vbs command attempt

FILE-PDF Adobe Acrobat ImageConversion PCX Parsing Out-Of-Bounds Write

I have had to temporarily disable the rule which permits access to Microsoft Services on my networks to stop the IPS alerts, because they continue constantly (as I assume Windows retries the download).

Some things to note:

  • SSL inspection is enabled and configured on the Windows hosts
  • XG Firewall version: SFOS 18.0.1 MR-1-Build396
  • IPS signature version: 18.17.27
  • This is occurring on all Windows Server 2019 devices, even freshly installed instances from an official ISO image in an isolated network.
  • The IPS policy enforced by the firewall rule incorporates 'All Categories' (mainly for testing purposes).

Does this mean that the Windows Updates being downloaded contains actual malware signatures, or is it more likely to be a false positive?

Any advice or assistance would be appreciated. If more details are needed, please ask and I will supply them.



This thread was automatically locked due to age.
Parents
  • 0

    Yes, seeing the same here. Glad I found this post as I was trying to figure out why 2019 boxes weren't updating.

  • +1 in reply to Joe Pruett

    After disabling 2200901 and 48053 I was finally able to download the cumulative update.

    One thing that is odd is that the text for 48053 is different in the logs (BROWSER-IE Microsoft Edge App-v vbs command attempt) vs what is in the policies page (OS-WINDOWS Microsoft Windows CVE-2018-8495 Script Host Command Injection).

  • 0 in reply to Joe Pruett

    Hello, Joe.

    Thank you for your input. Yes, I can confirm that making an exception for the above mentioned 'attacks' does indeed allow Windows Updates to succeed on the affected hosts.

    For anyone else who might need assistance, you can do this by modifying your existing IPS policy, and adding a new group (filter criteria) with the text of the intrusion (for example, "microsoft edge app-v vbs command") to the Smart Filter, then set the action to 'allow packet.' Make sure that the new filter criteria group is at the top of the list of filters in the IPS policy (processing order matters in this case).

    I'm still seeing the Adobe IPS alert as mentioned above from the Windows hosts when connecting to Microsoft servers.

    I think Sophos need to do an investigation into this, as making exceptions in an IPS policy is essentially a workaround. I haven't had time to contact them about it yet, but I'm sure that they would keep an eye on these forums.

Reply
  • 0 in reply to Joe Pruett

    Hello, Joe.

    Thank you for your input. Yes, I can confirm that making an exception for the above mentioned 'attacks' does indeed allow Windows Updates to succeed on the affected hosts.

    For anyone else who might need assistance, you can do this by modifying your existing IPS policy, and adding a new group (filter criteria) with the text of the intrusion (for example, "microsoft edge app-v vbs command") to the Smart Filter, then set the action to 'allow packet.' Make sure that the new filter criteria group is at the top of the list of filters in the IPS policy (processing order matters in this case).

    I'm still seeing the Adobe IPS alert as mentioned above from the Windows hosts when connecting to Microsoft servers.

    I think Sophos need to do an investigation into this, as making exceptions in an IPS policy is essentially a workaround. I haven't had time to contact them about it yet, but I'm sure that they would keep an eye on these forums.

Children
No Data