Security Center - Blocks for - Microsoft wimgapi LoadIntegrityInfo heap buffer overflow attemp

[JessIT1]

Seeing a ton of variations of this source being blocked to endpoints on 2 of our MX's

Source:  a23-48-99-86.deploy.static.akamaitechnologies.com - 23.48.99.86:80

Destination: network laptops

Blocked - Microsoft wimgapi LoadIntegrityInfo heap buffer overflow attempt

Virus Total shows clean

[alemabrahao]

Snort - Rule Docs 1:46055

Windows Update uses global CDNs (Akamai, Edgecast, Level3), not owned by Microsoft, so IP reputation checks can misfire.

[JessIT1]

From Meraki support:  

Microsoft wimgapi LoadIntegrityInfo heap buffer overflow attempt is further discussed here: https://blog.talosintelligence.com/vulnerability-spotlight-talos-2018-0545/

Our IDS uses SNORT and Cisco Talos, this kind of traffic has been linked to the above vulnerability exploitation.

It should be noted that Akamai is used by Windows for updates. If you have failed Windows updates, this could explain this activity.

Still doesn't quite explain all the blocks..

[JessIT1]

Latest response from Meraki:

So from what I can see, if you are in fact not getting windows updates, it would indicate that that is what these are; however, I would reach out to Microsoft and confirm this traffic first before white listing out of due diligence before doing so as I have no way to confirm that is exactly what this traffic is.

Cisco cannot tell if those blocks are or are not legitimate. They are flagged by our IDS database for the activity they are preforming--not for the IP address. Akamai is used by but not owned by Microsoft for updates, but is a provider of services and could be being utilized by others. Our advisement is to reach out to Microsoft to confirm the traffic if you've noticed that your windows updates are failing. If you do not have failing updates, then you need take no action.

I've checked out all the blocks on virus total, talos, all check out safe..so why is Meraki blocking..

[alemabrahao]

I believe that's something only support will be able to answer for you.