PassMark Logo
Home » Forum

Announcement

Collapse
No announcement yet.

Firewall blocking - malformed header

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Firewall blocking - malformed header

    Apologies if there is an existing thread for this issue.
    Our ZOOM search facility is not working for some user accessing our Intranet site.
    This is the report the firewall is returning:

    Attackzone external
    Category protocol_violation
    Cmd httpp
    Dest Port 80
    Dest Zone external
    Dst_geo GB
    Dst_local_port 80
    Event malformed header
    Facility http_proxy
    Hostname hostname
    Information X-Powered-By, ASP.NET
    Netsessid 5f67c5368d86b
    Protocol tcp
    Reason Malformed header, unable to find':'. Session terminated.
    Rule Name HTTP Access to External
    Source Port 64160
    Source Zone internal
    Src_local_port 0
    Syslog 4
    Syslog Warnings (4)
    Type attack

    Is there anything we need to do when indexing the site or do they need to do anything their end with the firewall settings?
    We are using ZOOM 10.6 (Build 1014)

  • #2
    I'm not clear what the situation is. Are you saying a user is accessing your Intranet site from outside your Intranet? e.g. over the Internet?

    What is the address they are accessing which invokes this error?

    Is this firewall installed on this user's computer? Is this computer within your Intranet or external to it?

    Or is this a firewall for your Intranet?

    Can they access any other page from your Intranet via the same protocol? i.e. http://123.456.789.1/someotherpage.html ?
    --Ray
    Wrensoft Web Software
    Sydney, Australia
    Zoom Search Engine

    Comment


    • #3
      The site is set up on an Intranet which is accessed over multiple sites. A series of LANS connecting to a WAN.

      They can access the rest of the site, but get this message when attempting to use the search facility.

      Comment


      • #4
        Can they access the search when they disable the firewall temporarily?

        Looking up the error message on Google, it seems to be from McAfee Firewall Enterprise.

        Here is their knowledge base article on how to address this issue:
        https://kc.mcafee.com/corporate/inde...ent&id=KB64283

        So a quick fix would be to follow the instructions linked above and add a bypass rule for the search page.

        The error message is very lacking however, in telling us what they found to be malformed about the header (or even which header)

        The header it is referring to could be something configured on your web server. Are there other .aspx pages on your site?

        Or it could also be due to the content of your search.aspx wrapper page (which would have been modified to suit your site's appearance).
        --Ray
        Wrensoft Web Software
        Sydney, Australia
        Zoom Search Engine

        Comment


        • #5
          Thank you. Now all ok. Good information form link above.

          Comment

          Working...
          X