[7.450][INFO] OWA to Exchange 2007 triggering IPS rule 8428

Hi,

I'm running the 7.450 software appliance beta on an ASG 110. Previously I was running 7.402 on another 110. Setup of the beta was easy, and importing my 7.402 backup worked perfectly. However, in v7.450 I'm finding that IPS rule 8428 ("WEB-MISC SSLv2 openssl get shared ciphers overflow attempt") is being triggered when attempting to use Outlook Web Access on my Exchange 2007 server. Disabling rule 8428 resolves the issue, but I'm wondering why this came up as I was running fine on 7.402 with this rule enabled, and accessing OWA in exactly the same way (IE 8 from the same PC as before).

I'm not sure if this is an issue with the new IPS engine, or simply due to a (very recent) patterns update, implying it would be an issue for non-beta users too. I suspect it's not a coincidence that this started happening immediately on my move to 7.450 though.

Anyone else run into this difference?

Parents

0 Pestilent over 16 years ago

Have you tried adding your exchange servers to the HTTP Servers section on the IPS Advanced tab? I was able to enable all IPS rules once I did so.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 MarCow over 16 years ago in reply to Pestilent

I just experimented with the HTTP Servers section of the IPS Advanced tab, and added my Exchange server. Having done that, I still see rule 8428 getting triggered. Disabling that rule appears to be the only solution. This still seems to be something that's been introduced with the new IPS engine though, given I had no issues running with that rule in place on 7.402 (on which I also did not have my Exchange server listed in the HTTP Servers section).

Interestingly, when hitting the same server via ActiveSync from my iPhone, traffic gets through without an issue. It seems to be specific to OWA access via Internet Explorer from what I can tell.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Monarch over 16 years ago in reply to MarCow

Hi,

I'm also using OWA with Exchange 2007 here, but until 7.402 I had no IPS alarms in connection to that. Will test it tomorrow when I can access it from work (could test it by using a mobile UMTS connection, but that costs money) [;)]

Regards,
Bastian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Monarch over 16 years ago in reply to Monarch

Update: just tested it, IPS also blocks access to OWA here.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 MarCow over 16 years ago in reply to Monarch

OK thanks - so it looks like this is a change in behavior from 7.402 to 7.450. With the same patterns on both versions, OWA access triggers rule 8428 on 7.450, but not on 7.402. Is that correct from your side? That's certainly what I saw.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Pestilent over 16 years ago in reply to Monarch

What version of Exchange is running on everyone's OWA servers? The account I have been using to test is on a 2003 OWA box and I am able to access it with all IPS rules set to DROP.
I know there were a lot of changes made between OWA 2003 and 2007, so I wonder if these just weren't taken into account in the HTTP server IPC exceptions.

Is anyone else running 2003 OWA that can confirm it does or does not work for them?
I am curious if it's just a fluke that I have the rule enabled or what...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Pestilent over 16 years ago in reply to Monarch

What version of Exchange is running on everyone's OWA servers? The account I have been using to test is on a 2003 OWA box and I am able to access it with all IPS rules set to DROP.
I know there were a lot of changes made between OWA 2003 and 2007, so I wonder if these just weren't taken into account in the HTTP server IPC exceptions.

Is anyone else running 2003 OWA that can confirm it does or does not work for them?
I am curious if it's just a fluke that I have the rule enabled or what...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 MarCow over 16 years ago in reply to Pestilent

I'm using Exchange 2007 on Windows Server 2003. Unfortunately I don't have an Exchange 2003 box handy to compare the behavior between the two Exchange versions.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel