ipapercms blocked by WebMon 4.1

	Forums Register Login My Profile Inbox Address Book My Subscription My Forums Member List Search FAQ Ticket List Log Out

ipapercms blocked by WebMon 4.1

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Web & Mail Security] >> GFI WebMonitor >> ipapercms blocked by WebMon 4.1

Page: [1]

Message

<< Older Topic Newer Topic >>

ipapercms blocked by WebMon 4.1 - 6.Nov.2008 10:51:26 AM

Zixyar

Posts: 5
Joined: 4.Apr.2004
Status: offline

URL is http://www.ide.dk/sw47502.asp referring to a file located at submit.ipapercms.dk

With the above URL (or my ip address) in whitelist everything works fine, but with WebMon (already upgraded to 4.1) ISA server logs a "Failed Connection Attempt" with this Result Code:

12210 An Internet Server API (ISAPI) filter has finished handling the request. Contact your system administrator.

and the document can't be seen (it's flash content).
I think it's DownloadMonitor blocking

http://submit.ipapercms.dk/Inbodan/InbohomeAmba/IDEprislister/1899954/Loader.asmx/GetManifest

Any hint?

< Message edited by Zixyar -- 6.Nov.2008 11:27:13 AM >

Post #: 1

RE: ipapercms blocked by WebMon 4.1 - 6.Nov.2008 11:30:13 AM

Zixyar

Posts: 5
Joined: 4.Apr.2004
Status: offline

Nevermind, easy shot... disabled download progress & status for zip files and everything works now.

Bye, Zix.

(in reply to Zixyar)

Post #: 2

RE: ipapercms blocked by WebMon 4.1 - 6.Nov.2008 12:42:14 PM

davidf

Posts: 143
Joined: 29.Jul.2003
Status: offline

I would not recommend to turn off DownloadStatus window off for zip files for all downloads.
Reason: When 0day exploits in your flash player or in pdf viewer or in any web browser module is executed it usually downloads another big application which is often zip compressed (since winxp has zip build-in).

What I recommend is to whitelist sites which needs zip files to be downloaded automatically without user supervision.

In your case Loader.asmx/GetManifest is sending zipped content to flashplayer which unzips content for iPaper (flashpaper project/filetype). This zip download got replaced with html requiring user intervention which was not understoon/rendered/handled by flash player and hanged consequently.

I suggest to put just that site to whitelist if you trust it.. or create virus scanning rules with zipfiles not producing DS window but only for yourself not for everybody on your LAN.

From our side ultimate solution would be to add fnew real filetyle iPaper( or flashpaper). We might do it once we get more requests for this format to be supported.

With Kind Regards DavidF

(in reply to Zixyar)

Post #: 3