http://support.microsoft.com/kb/823175 is the relevant article. The example .ini file blocks '\', '%', '&' and the article text explains the ramifications. I was trying to get a feel for how much risk allowing these characters would introduce, but I suppose that depends on what bugs are found in OWA & IIS. I'm getting the impression most people don't install URLscan on their OWA servers.
-----Original Message----- From: Michael B. Smith [mailto:[email protected]] Sent: Thursday, July 14, 2011 3:51 PM To: MS-Exchange Admin Issues Subject: RE: OWA 2003 & URLScan For clarity's sake: when I say "it specifically warns", there is text in the configuration file that has the warning. There isn't a pop-up or event error or anything. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Michael B. Smith [mailto:[email protected]] Sent: Thursday, July 14, 2011 4:43 PM To: MS-Exchange Admin Issues Subject: RE: OWA 2003 & URLScan URLscan is a DLL module that loads into the IIS process. Technically you could call it MITM, but no more so than a loadable module in Apache. Insofar as configuring it is concerned - there is specific configuration recommended for Exchange. If you go beyond that configuration (which the OP has), then it specifically warns that you WILL have issues. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Kurt Buff [mailto:[email protected]] Sent: Thursday, July 14, 2011 3:49 PM To: MS-Exchange Admin Issues Subject: Re: OWA 2003 & URLScan On Thu, Jul 14, 2011 at 08:13, Osborne, Richard <[email protected]> wrote: > I have URLscan installed on my Outlook Web Access 2003 server. It is > set to block '\', '%', and '&' characters in the hope of making the > server more secure. Unfortunately this causes e-mails that use those > characters in the Subject not to open. Am I being unreasonably > paranoid? Do you allow these characters? Thanks. > > > Richard Osborne So, this sounds like URLscan MITMs the HTTPS conversation. Did you feed it the cert key so that it can decrypt the streams? I've never played with that product, but those characters are deprecated in the RFCs as being unsafe. Too paranoid? I don't think so, but this will ultimately be a political call, and you're likely to lose, unless you can get them to believe you when you point to the RFCs. Kurt --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist
