topic Re: Outlook Web Access Cross Site Scripting Vulnerability in Network Security https://community.cisco.com/t5/network-security/outlook-web-access-cross-site-scripting-vulnerability/m-p/493799#M97812 <HTML><HEAD></HEAD><BODY><P>Hi Radhika, </P><P>Many thanks for your reply. </P><P>I am using signature update IDS-sig-4.1-4-S183.rpm.pkg and I am still seeing these events.</P></BODY></HTML> Thu, 18 Aug 2005 07:23:17 GMT darin.marais 2005-08-18T07:23:17Z Outlook Web Access Cross Site Scripting Vulnerability https://community.cisco.com/t5/network-security/outlook-web-access-cross-site-scripting-vulnerability/m-p/493797#M97760 <P>The signature for &#147;Outlook Web Access Cross Site Scripting Vulnerability&#148; does not permit the user to see the regular expression that is used by the signature to capture events. </P><P></P><P>The signature is often triggered for packets similar to the one below when internal users connect on internet web pages.</P><P></P><P>..~...........E.....@.&gt;..~......I8.L..w...4G.TP.......piegel.de/css/0,5459,PB64-dmVyPWxvdyZyZXY9MjAwNTA4MTYyMjQ0MDUmc3R5bGU9,00.css"&gt;.&lt;link rel="stylesheet" type="text/css" href="<A class="jive-link-custom" href="http://www.spiegel.de/css/0,5459,PB64-dmVyPWZ1bGwmcmV2PTIwMDUwODE2MjI0NDA1JnN0eWxlPQ_3_3,00.css" target="_blank">http://www.spiegel.de/css/0,5459,PB64-dmVyPWZ1bGwmcmV2PTIwMDUwODE2MjI0NDA1JnN0eWxlPQ_3_3,00.css</A>" media="screen, projection, print"&gt;.&lt;link rel="shortcut icon" href="<A class="jive-link-custom" href="http://www.spiegel.de/favicon.ico" target="_blank">http://www.spiegel.de/favicon.ico</A>" type="image/ico"&gt;.....&lt;link rel="stylesheet" href="/main/css/style.css" type="text/css" /&gt;...&lt;script type="text/javascript" language="JavaScript" src="/main/css/parship.js"&gt;&lt;/script&gt;.&lt;/head&gt;.&lt;body id="www-spiegel-de" bgcolor="#FFFFFF" text="#000000" link="#B20A15" vlink="#B20A15" alink="#ff0000"&gt;.&lt;!-- SZM VERSION="1.3" --&gt;.&lt;script type="text/javascript"&gt;.&lt;!--.var IVW="<A class="jive-link-custom" href="http://spiegel.ivwbox.de/cgi-bin/ivw/CP/1008;/panorama/c-10/r-1228/tpl-Parship/be-PB64-cGFub3JhbWEvcGFyc2hpcC9hcnRpa2Vs/~~addcountinfohere~~/szwprofil-1008" target="_blank">http://spiegel.ivwbox.de/cgi-bin/ivw/CP/1008;/panorama/c-10/r-1228/tpl-Parship/be-PB64-cGFub3JhbWEvcGFyc2hpcC9hcnRpa2Vs/~~addcountinfohere~~/szwprofil-1008</A>";.document.write('&lt;img src="'+IVW+'?r='+escape(document.referrer)+'&amp;d='+(Math.random()*100000)+'" width="1" height="1" border="0" align="right" alt=""&gt;');.// --&gt;.&lt;/script&gt;.&lt;noscript&gt;.&lt;img src="<A class="jive-link-custom" href="http://spiegel.ivwbox.de/cgi-bin/ivw/CP/1008;/panorama/c-10/r-1228/tpl-Parship/be-PB64-cGFub3JhbWEvcGFyc2hpcC9hcnRpa2Vs/~~addcountinfohere~~/szwprofil-1008" target="_blank">http://spiegel.ivwbox.de/cgi-bin/ivw/CP/1008;/panorama/c-10/r-1228/tpl-Parship/be-PB64-cGFub3JhbWEvcGFyc2hpcC9hcnRpa2Vs/~~addcountinfohere~~/szwprofil-1008</A>" width="1" height="1" border="0" align="right" alt=""&gt;.&lt;/noscript&gt;.&lt;!-- /SZM --&gt;.&lt;img src="<A class="jive-link-custom" href="http://www.spiegel.de/cgi-bin/vdz/CP/spiegel/panorama/c-10/r-1228/tpl-Parship/be-PB64-cGFub3JhbWEvcGFyc2hpcC9hcnRpa2Vs/~&amp;#12" target="_blank">http://www.spiegel.de/cgi-bin/vdz/CP/spiegel/panorama/c-10/r-1228/tpl-Parship/be-PB64-cGFub3JhbWEvcGFyc2hpcC9hcnRpa2Vs/~&amp;#12</A>...;</P><P></P><P>What recommended action could be taken for tuning out the noise from this signature??</P><P></P><P>Thanks in advance</P> Sun, 10 Mar 2019 09:35:16 GMT https://community.cisco.com/t5/network-security/outlook-web-access-cross-site-scripting-vulnerability/m-p/493797#M97760 darin.marais 2019-03-10T09:35:16Z Re: Outlook Web Access Cross Site Scripting Vulnerability https://community.cisco.com/t5/network-security/outlook-web-access-cross-site-scripting-vulnerability/m-p/493798#M97788 <HTML><HEAD></HEAD><BODY><P>We identified a false positive condition in the S181 version of the signature and released a modified one in S182. If you have S182 or greater on the sensor and are still seeing those alerts, we will research this signature for further modification. Please tell us at what signature update level the sensor is.</P><P></P><P>Thanks,</P><P>Radhika</P></BODY></HTML> Wed, 17 Aug 2005 16:56:19 GMT https://community.cisco.com/t5/network-security/outlook-web-access-cross-site-scripting-vulnerability/m-p/493798#M97788 rupadras 2005-08-17T16:56:19Z Re: Outlook Web Access Cross Site Scripting Vulnerability https://community.cisco.com/t5/network-security/outlook-web-access-cross-site-scripting-vulnerability/m-p/493799#M97812 <HTML><HEAD></HEAD><BODY><P>Hi Radhika, </P><P>Many thanks for your reply. </P><P>I am using signature update IDS-sig-4.1-4-S183.rpm.pkg and I am still seeing these events.</P></BODY></HTML> Thu, 18 Aug 2005 07:23:17 GMT https://community.cisco.com/t5/network-security/outlook-web-access-cross-site-scripting-vulnerability/m-p/493799#M97812 darin.marais 2005-08-18T07:23:17Z Re: Outlook Web Access Cross Site Scripting Vulnerability https://community.cisco.com/t5/network-security/outlook-web-access-cross-site-scripting-vulnerability/m-p/493800#M97837 <HTML><HEAD></HEAD><BODY><P>Hi Darin,</P><P></P><P>Thank you very much for your feedback. We think we have identified the problem. A modified signature will be released in an upcoming signature update.</P></BODY></HTML> Thu, 18 Aug 2005 14:37:05 GMT https://community.cisco.com/t5/network-security/outlook-web-access-cross-site-scripting-vulnerability/m-p/493800#M97837 rupadras 2005-08-18T14:37:05Z