0002753: frox not working

Endian Issue Tracker

Viewing Issue Simple Details [ Jump to Notes ]

[ View Advanced ] [ Issue History ] [ Print ]

Category

Severity

Reproducibility

Date Submitted

Last Update

0002753

[Endian Firewall] Other Services

minor

have not tried

2010-03-08 10:38

2010-06-07 16:01

Reporter

lucagiove

View Status

public

Assigned To

Priority

normal

Resolution

open

Status

acknowledged

Product Version

2.3

Summary

0002753: frox not working

Description

1) Frox:
The old problem, when FROX are enabling, no ftp transfer is possible with the browser (example Firefox) => In Version 2.2, in Version 2.3 no connection is possible.
When I use an FTP Client, a FTP communication is possible.
So, I test a virus file from this link:
ftp://download.trendmicro.com/products/eicar-file/eicar.com [^]
I download is possible.

FTP Log:
Befehl: PORT 192,168,183,100,9,11
Antwort: 200 PORT command successful.
Befehl: RETR normal.exe
Antwort: 150-Starting Transfer
Antwort: 150-There'll be a delay while we scan for viruses
Antwort: 150-Scanning file for viruses
Antwort: 150 Starting Transfer
Antwort: 226 Transfer Complete

FROX Log:
Oct 26 10:27:08 2009 frox[5143] Connect from 192.168.183.100
Mon Oct 26 10:27:08 2009 frox[5143] ... to 213.248.114.165()
Mon Oct 26 10:27:09 2009 frox[5143] Command FEAT not implemented
Mon Oct 26 10:27:28 2009 frox[5146] Connect from 192.168.183.100
Mon Oct 26 10:27:28 2009 frox[5146] ... to 213.248.114.165()
Mon Oct 26 10:27:41 2009 frox[5146] 192.168.183.100 DOWNLOADED anonymous@213-248-114-165.customer.teliacarrier.com/%2fproducts%2feicar-file/normal.exe">ftp://anonymous@213-248-114-165.customer.teliacarrier.com/%2fproducts%2feicar-file/normal.exe [anonymous@213-248-114-165.customer.teliacarrier.com/%2fproducts%2feicar-file/normal.exe" target="_blank">^] VIRUS_CLEAN
Mon Oct 26 10:28:40 2009 frox[5146] 192.168.183.100 DOWNLOADED anonymous@213-248-114-165.customer.teliacarrier.com/%2fproducts%2feicar-file/TestMal_GenRunValue.exe">ftp://anonymous@213-248-114-165.customer.teliacarrier.com/%2fproducts%2feicar-file/TestMal_GenRunValue.exe [anonymous@213-248-114-165.customer.teliacarrier.com/%2fproducts%2feicar-file/TestMal_GenRunValue.exe" target="_blank">^] VIRUS_CLEAN
Mon Oct 26 10:29:12 2009 frox[5146] 192.168.183.100 DOWNLOADED anonymous@213-248-114-165.customer.teliacarrier.com/%2fproducts%2feicar-file/normal.exe">ftp://anonymous@213-248-114-165.customer.teliacarrier.com/%2fproducts%2feicar-file/normal.exe [anonymous@213-248-114-165.customer.teliacarrier.com/%2fproducts%2feicar-file/normal.exe" target="_blank">^] VIRUS_CLEAN
Mon Oct 26 10:30:13 2009 frox[5146] Client closed connection
Mon Oct 26 10:30:13 2009 frox[5146] Closing session
Mon Oct 26 10:32:18 2009 frox[5143] Connection timed out.
Mon Oct 26 10:32:18 2009 frox[5143] Closing session

I should get a warning from FROX? And what make FROX when the information comes in the LOG File: VIRUS_CLEAN?

Additional Information

Issue History
Date Modified	Username	Field	Change
2010-03-08 10:38	lucagiove	New Issue
2010-03-08 10:38	lucagiove	Tag Attached: purple
2010-03-08 13:05	peter	Note Added: 0003969
2010-03-08 13:05	peter	Status	new => acknowledged
2010-06-07 16:01	peter	Target Version	=> future

Notes
(0003969) peter (administrator) 2010-03-08 13:05	ok, frox should not let pass that file, needs to reproduce that is firefox configured to use a http proxy? then it uses the proxy and does not use frox.

Relationships