Gizmodo/Lifehacker being blocked. - Page 2

dmorris · 06-29-2011, 09:16 PM

http://forums.untangle.com/intrusion...ion-9-0-a.html

razvandudu · 07-04-2011, 05:59 AM

Iv'e had a similar problem with Yahoo Mail (the new "improved" interface").
In the Yahoo interface I've got many ("JSON ...") error message boxes, some of them saying just that there is something wrong and some yelding HTTP 200 error(s).
More than that, when trying to install YM v11, the installer complained that there is a "network problem" and it can't download the necessary files.
I've traced the problem to the "Intrusion Prevention" module, rules #11687 ("WEB-MISC Apache SSI error page cross-site scripting") and #8734 ("WEB-PHP Pajax arbitrary command execution attempt").
After disabling those rules, all yahooish things were running again smoothly.
I don't want to turn off Intrusion Prevention (it's usefull after all), so I'm contemplating modifying those above mentioned rules to accept yahooish things from yahooish servers and still blocking the rest as before. I don't want to reinvent the wheel, though. So, anybody with an ideea?

xsara · 07-05-2011, 09:01 PM

nab.com.au got us as well, couldn't figure out where it was being blocked, thought it must have been an upstream issue! doh!

n9lf · 08-12-2011, 12:20 PM

Has anyone had the same problem, even without Intrusion Prevention? I did the V8 -> V9 upgrade today, and immediately started intermittently getting the JSON error messages in Yahoo Mail.

I did the unblock on #11687 and #8734, but still get the errors (still intermittently).

Even after removing Int Prev, I'm getting the same errors. Clearly something else is involved, so before I go digging, does anyone have any other clues?

Thanks,

Tim

dmorris · 08-12-2011, 02:08 PM

Quote:

Originally Posted by n9lf

Has anyone had the same problem, even without Intrusion Prevention? I did the V8 -> V9 upgrade today, and immediately started intermittently getting the JSON error messages in Yahoo Mail.

I did the unblock on #11687 and #8734, but still get the errors (still intermittently).

Even after removing Int Prev, I'm getting the same errors. Clearly something else is involved, so before I go digging, does anyone have any other clues?

Thanks,

Tim

http://forums.untangle.com/intrusion...ion-9-0-a.html

miw · 08-12-2011, 09:14 PM

Every few years Yahoo decides to make substantial changes to the Yahoo Mail system. You may be encountering a Yahoo system "upgrade"/"enhancement" and having issues with UT at the same time. I can attest that Intrusion Prevention rule 8734 is the root of a number of false positives and disabling it significantly reduces the number of communication blocks. If you disabled that rule and are still having problems see http://answers.yahoo.com/question/in...0124622AASqeOb
http://uk.answers.yahoo.com/question...2041058AA7rEmJ
http://developer.yahoo.com/forum/Yah...b-190789193381

Best Luck

06-29-2011, 09:16 PM	#11 (permalink)
dmorris Untangle Junkie Join Date: Nov 2006 Location: San Mateo, CA URLs submitted: 10 Posts: 10,612	http://forums.untangle.com/intrusion...ion-9-0-a.html __________________ Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself. If you need Untangle support please call or email support@untangle.com

Protect

Filter

Perform

Connect

Manage

Add-Ons

07-04-2011, 05:59 AM	#12 (permalink)
razvandudu Newbie Join Date: Jun 2011 Location: Bucharest, ROMANIA Posts: 1	Iv'e had a similar problem with Yahoo Mail (the new "improved" interface"). In the Yahoo interface I've got many ("JSON ...") error message boxes, some of them saying just that there is something wrong and some yelding HTTP 200 error(s). More than that, when trying to install YM v11, the installer complained that there is a "network problem" and it can't download the necessary files. I've traced the problem to the "Intrusion Prevention" module, rules #11687 ("WEB-MISC Apache SSI error page cross-site scripting") and #8734 ("WEB-PHP Pajax arbitrary command execution attempt"). After disabling those rules, all yahooish things were running again smoothly. I don't want to turn off Intrusion Prevention (it's usefull after all), so I'm contemplating modifying those above mentioned rules to accept yahooish things from yahooish servers and still blocking the rest as before. I don't want to reinvent the wheel, though. So, anybody with an ideea?

07-05-2011, 09:01 PM	#13 (permalink)
xsara Untangler Join Date: Jul 2008 Posts: 39	nab.com.au got us as well, couldn't figure out where it was being blocked, thought it must have been an upstream issue! doh!

08-12-2011, 12:20 PM	#14 (permalink)
n9lf Newbie Join Date: May 2009 Posts: 10	Has anyone had the same problem, even without Intrusion Prevention? I did the V8 -> V9 upgrade today, and immediately started intermittently getting the JSON error messages in Yahoo Mail. I did the unblock on #11687 and #8734, but still get the errors (still intermittently). Even after removing Int Prev, I'm getting the same errors. Clearly something else is involved, so before I go digging, does anyone have any other clues? Thanks, Tim

08-12-2011, 09:14 PM	#16 (permalink)
miw Untangler Join Date: Jun 2008 Posts: 32	Every few years Yahoo decides to make substantial changes to the Yahoo Mail system. You may be encountering a Yahoo system "upgrade"/"enhancement" and having issues with UT at the same time. I can attest that Intrusion Prevention rule 8734 is the root of a number of false positives and disabling it significantly reduces the number of communication blocks. If you disabled that rule and are still having problems see http://answers.yahoo.com/question/in...0124622AASqeOb http://uk.answers.yahoo.com/question...2041058AA7rEmJ http://developer.yahoo.com/forum/Yah...b-190789193381 Best Luck