Die SmartDefense Sachen werden normalerweise relativ gut im Log geführt.
Ich habe gerade mal in HELP reingeschaut und wir hatten einmal ein ähnliches Problem:
reason: WSE0060003 invalid character detected in response headers: '0xfc'
...aber das ist halt relativ klar, wobei auch bei Dir das Problem ja klar auf der Gegenseite zu liegen scheint!? Malformed = missgebildet, d.h. für mich das sich der Webserver irgendwie nicht standard-konform verhält....
Vielleicht bringt Dir der Eintrag aus der Knowledgebase was:
https://secureknowledge.checkpoint.com/SecureKnowledge/viewSolutionDocument.do?id=sk17782Disabling SmartDefense from checking TCP port 80 (HTTP protocol)for Header Detection and Worm Catcher
Print this Solution
Email this Solution
New Search / Advanced
Prev / Next Solution
Solution ID: #sk17782
Product: SmartDefense
Version: NG
Last Modified: 24-Mrz-2004
Solution
Starting from NG FP3, SmartDefense Application Intelligence features are automatically activated for TCP port 80 (A.K.A. HTTP protocol)
Below are some of the added value security features:
Being able to enforce inside HTTP Packets several HTTP parameters which have security implications for protecting against denial of service such as:
1. Maximum number of Http Headers in a http request
2. Maximum http URL length
3. Maximum http header length (in FP3 configurable to more then 1000 only via the file: asm.C)
4. ASCII Only request headers – will drop packets with http headers which are submitted to web servers with non ASCII values as data.
5. ASCII Only response headers - will drop packets with http headers which are received from web servers with non ASCII values as data.
Though some of these features can be disabled separately, you can disable all of them at once and thus turn the default HTTP service in Check Point SmartDashboard to a simple TCP service where the FireWall-1 does not look into the packets data.
How to do it:
1. Open the http service, click on the advanced button
2. From the “service type” drop down box – select: “none” (where initially it shows: HTTP which redirects this tcp port into the SmartDefense Engine.)
3. Save and install the policy.
