Hi,
after upgrading to UTM9.1, fileuploads via our website fail when Dual Scan is enabled in our Web Application Firewall. Changing to single scan resolves the issue.
This same issue existed in UTM9, but was fixed. Now with UTM9.1 it's back again.
the logs show this:
2013:05:21-12:03:46 firewall reverseproxy: [Tue May 21 12:03:46.754826 2013] [security2:error] [pid 28826:tid 4104735600] [client ] ModSecurity: Access denied with code 400 (phase 2). File "/tmp/20130521-120346-UZtGgk08OXIAAHCaO3EAAACD-file-NJF5vy" rejected by the approver script "/usr/apache/bin/modsecurity_av.sh DualScan BlockUnscannable": 0 syntax: DualScan scan mode invalid [file "/usr/apache/conf/reverseproxy.conf"] [line "116"] [msg "Virus found in upload"] [hostname ""] [uri ""] [unique_id "UZtGgk08OXIAAHCaO3EAAACD"]
2013:05:21-08:51:16 firewall reverseproxy: [Tue May 21 08:51:16.874980 2013] [security2:error] [pid 31732:tid 4045986672] [client ] ModSecurity: Access denied with code 400 (phase 2). File "/tmp/20130521-085116-UZsZZE08OXIAAHv06QIAAABK-file-oxjTPU" rejected by the approver script "/usr/apache/bin/modsecurity_av.sh DualScan BlockUnscannable": 0 syntax: DualScan scan mode invalid [file "/usr/apache/conf/reverseproxy.conf"] [line "116"] [msg "Virus found in upload"] [hostname ""] [uri ""] [unique_id "UZsZZE08OXIAAHv06QIAAABK"]
2013:05:21-09:01:00 firewall reverseproxy: [Tue May 21 09:01:00.078224 2013] [security2:error] [pid 1594:tid 3920096112] [client ] ModSecurity: Access denied with code 400 (phase 2). File "/tmp/20130521-090059-UZsbq008OXIAAAY60cUAAAAZ-file-Fd6Ejj" rejected by the approver script "/usr/apache/bin/modsecurity_av.sh DualScan BlockUnscannable": 0 syntax: DualScan scan mode invalid [file "/usr/apache/conf/reverseproxy.conf"] [line "116"] [msg "Virus found in upload"] [hostname ""] [uri ""] [unique_id "UZsbq008OXIAAAY60cUAAAAZ"]
2013:05:21-11:45:48 firewall reverseproxy: [Tue May 21 11:45:48.819397 2013] [security2:error] [pid 26485:tid 3911703408] [client ] ModSecurity: Access denied with code 400 (phase 2). File "/tmp/20130521-114542-UZtCRk08OXIAAGd11DcAAAAa-file-6c1yNS" rejected by the approver script "/usr/apache/bin/modsecurity_av.sh DualScan BlockUnscannable": 0 syntax: DualScan scan mode invalid [file "/usr/apache/conf/reverseproxy.conf"] [line "116"] [msg "Virus found in upload"] [hostname ""] [uri ""] [unique_id "UZtCRk08OXIAAGd11DcAAAAa"]
This thread was automatically locked due to age.