From: Lorentz, Brian (blorentzucsd.edu)
Date: Thu Oct 27 2005 - 10:25:04 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hic,

We had this problem but it was with the majority of our Proventia
Desktops. The issue was related to Microsoft SUS updates, and manual
windows updates to some extent. All of our desktops' SUS windows
updates were being blocked by the Proventia Desktop. This problem
started a few months back and continued until we added an exception in
the policy for HTTP_Proxy_Cache_Poisoning

To solve this problem, we had to create a rule that trusted "myself" for
Event ID 2116017 (HTTP_Proxy_Cache_Poisoning).

You may want to look at the windows update process on your server first.

Good luck,
- Brian

-----Original Message-----
From: issforum-bouncesiss.net [mailto:issforum-bouncesiss.net] On
Behalf Of hic sonni
Sent: Sunday, October 23, 2005 6:52 AM
To: issforumiss.net
Subject: [ISSForum] HTTP_Proxy_Cache_Poisoning ?

Hi All,

Hi All,
We've a Web Site (based on IIS) behind a firewall,a
Server Sensor is installed on that Server, I am
getting the event :

"HTTP_Proxy_Cache_Poisoning" , and the Status is :
"Failed attack (blocked at host)"

The thing that I find abnormal: is that this event is
from the Local Server to the Internet, (Inside-->
outside), more, we have neither a Proxy behind the
machine nor a proxy is installed on the Server,

My question is:

Why I ma getting "Failed attack (blocked at host)"
since the event (attack) is outgoing from the Server?

I remarked that the access to our site is somehow
slow, does the BLOKE action involve it?

Thanks
Hic Sonni

                
__________________________________
Yahoo! FareChase: Search multiple travel sites in one click.
http://farechase.yahoo.com

_______________________________________________
ISSForum mailing list
ISSForumiss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforumiss.net

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

_______________________________________________
ISSForum mailing list
ISSForumiss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforumiss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]