Hic, We had this problem but it was with the majority of our Proventia Desktops. The issue was related to Microsoft SUS updates, and manual windows updates to some extent. All of our desktops' SUS windows updates were being blocked by the Proventia Desktop. This problem started a few months back and continued until we added an exception in the policy for HTTP_Proxy_Cache_Poisoning
To solve this problem, we had to create a rule that trusted "myself" for Event ID 2116017 (HTTP_Proxy_Cache_Poisoning). You may want to look at the windows update process on your server first. Good luck, - Brian -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of hic sonni Sent: Sunday, October 23, 2005 6:52 AM To: [email protected] Subject: [ISSForum] HTTP_Proxy_Cache_Poisoning ? Hi All, Hi All, We've a Web Site (based on IIS) behind a firewall,a Server Sensor is installed on that Server, I am getting the event : "HTTP_Proxy_Cache_Poisoning" , and the Status is : "Failed attack (blocked at host)" The thing that I find abnormal: is that this event is from the Local Server to the Internet, (Inside--> outside), more, we have neither a Proxy behind the machine nor a proxy is installed on the Server, My question is: Why I ma getting "Failed attack (blocked at host)" since the event (attack) is outgoing from the Server? I remarked that the access to our site is somehow slow, does the BLOKE action involve it? Thanks Hic Sonni __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
