Bug ID 441495: ASM ICAP protection closes connection upon client close-connection.

Last Modified: Jul 12, 2023

Affected Product(s):
BIG-IP ASM(all modules)

Known Affected Versions:
11.2.1

Fixed In:
11.6.0

Opened: Dec 23, 2013

Severity: 3-Major

Symptoms

You encounter frequent ICAP failures when uploading files. This creates an issue where the client connection closes a connection before the transaction completes (and results in a false positive virus scan).

Impact

Results in a false positive virus scan.

Conditions

When ICAP ASM protection is enabled, there is an issue where the client connection closes a connection before the an transaction completes.

Workaround

N/A

Fix Information

When the payload is about to go to the anti-virus server for inspection, the Enforcer now tests whether the client is still connected, and if it is not, the Enforcer does not send the request to the anti-virus server, and it does not issue a virus found violation.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips