[7.450][BUG][FIXED] unable to login into OWA - blocked by IPS

since I begin to use this beta I can't login to my exchange OWA. I get the login window but after I put the credential it doesn't open the page:

https://myexchangeserver.com/owa/auth/owaauth.dll

0 BAlfson over 15 years ago in reply to Pestilent

Thanks, Pestilent. Now, Gnomme, using the Intrusion Protection log, what rule causes the blocking of OWA traffic?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 15 years ago in reply to BAlfson

MarCow has belled the cat: https://community.sophos.com/products/unified-threat-management/astaroorg/f/98/t/67552

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 15 years ago in reply to BAlfson

Good catch, Simon. You're right, the issue is HTTP/S, not SMTP!

Gnomme, the right question is whether you have the OWA server in 'HTTP Servers' on the 'Advanced' tab.

Cheers - Bob

Yes I have! Here is the message I recieve in email alerts:

Details about the intrusion alert:

Message........: WEB-MISC SSLv2 openssl get shared ciphers overflow attempt
Details........: http://www.snort.org/pub-bin/sigs.cgi?sid=8428
Time...........: 2009:06:03-19:13:19
Packet dropped.: yes
Priority.......: 1 (high)
Classification.: Attempted Administrator Privilege Gain
IP protocol....: 6 (TCP)
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 chow11 over 15 years ago in reply to gnomme

I ran into this. I have IE 8, FireFox and Google Chrome, and the rule only triggers for IE 8. (of course for the other browsers, you can only log in with owa light which does not use active X).

Creating an IPS->Advanced->Modified rule and disabling 8482 worked for me.
FYI, if you host a phpBB3 forum, you also need to disable 2229.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 nitehawk over 15 years ago in reply to BAlfson

gnomme, cannot confirm this one. Can you please provide more details?
Which IPS rule is the one to blame for this?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 15 years ago in reply to nitehawk

I think is: Attacks against Servers
not sure...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Astaro Beta Bot over 15 years ago in reply to gnomme

Astaro Beta Report
--------------------------------
Version: 7.450
Type: BUG
State: FIXED
Reporter: gnomme
Contributor: 
MantisID: 0010623
--------------------------------

0 andyk007 over 15 years ago

is the problem still existing in 7.470? I'm not able to reproduce it in any way.

greetings
Andreas
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to andyk007

Rule 8428 is a bad rule, it falsely triggers when OWA is used... I've been disabling that rule for a year or 2 now, right out of the box.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 andyk007 over 15 years ago

ok I forwarded the OWA false postivie to R&D

greetings
Andreas
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel