Endpoint Protection

After my WinXP SP3 workstations were auto-updated with LiveUpdate yesterday and today, our Java-based application which uses ActiveX no longer functions correctly. Our application uses ActiveX to populate a pull-down menu. When this is attempted we get the following notification:

[SID: XXXXX] HTTP MS TDCCTL Control ActiveX BO detected.
Traffic has been blocked from this application: C:\Program Files\Internet Explorer\iexplore.exe

According to this Symantec Security Response page (http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=sep&pvid=sep11_32&year=2010&suid=SAV11_32-SU145-20100429.001), coverage is added for four vunlerabilities and threats. Among these is "HTTP MS TDCCTL Control ActiveX BO". This looks remarkably like the notification message above. I have disabled Network Threat Protection temporarily to circumvent the incompatibility with our application, but this is unacceptable as a permanent solution. I need a way to allow this type of traffic from our remote host. A perusal of the security log inside client management reveals Intrusion Prevention events with TCP and the IP address of our application host server.

My workstations are using IE8 and are being affected even though the vulnerability supposedly only affects IE6. Any insight or suggestions are greatly appreciated. Thanks.

You can create an IPS exception for this. Change the action to "Allow".

You can add the SID  23692 for "HTTP MS TDCCTL Control ActiveX BO" to exception list

From SEPM -Policies-Intrusion Prevention- Exceptions- ADD -Select the SID 23692
("HTTP MS TDCCTL Control ActiveX BO") -Next -Action Allow/Log -OK

Apply this policy to all your groups.

Is there a way to set the rule(s) to apply only to one host or subnet? After all, it is supposedly a valid threat/vulnerability. Thanks!

You cannot set it to one client or subnet it can only be applied to a group or groups in SEPM.