For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ML_62682's avatar
ML_62682
Icon for Nimbostratus rankNimbostratus
Dec 22, 2008

Problem with ClickOnce programs

I have an application that stops running everytime I run Firepass. We use ClickOnce technology for deployment of the application; that way the app will be updated automatically every time there is a n...
BIG-IP Access Policy Manager (APM)
remote access
security
Michel_Belleau_'s avatar
Michel_Belleau_
Icon for Nimbostratus rankNimbostratus
Oct 03, 2014

Hi there.

 

I know this is an ancient thread, but as it still stands unanswered and I came up with exactly the same issue a latter version of the F5 SSL VPN software, I thought that would be good to share my findings.

 

The exact cause of not being able to install a ClickOnce application when on the SSL VPN, might be because of the way F5 has decided to configure the network proxy settings while on the VPN.

 

If you are using WPAD (wpad.dat file) to get your proxy configuration to the end-users, at VPN establishement the F5 client will cache a (slightly modified) copy of the wpad.dat file locally. It stores the configuration in the dial-up connection settings and references the file using a file:// URI.

 

Microsoft issued a security advisory (MS12-074: Vulnerabilities in .NET Framework could allow remote code execution) that disables file:// WPAD parsing for WinINET/.NET components that I believe the ClickOnce installer is using.

 

Effectively, ClickOnce applications will not work when on a F5 SSL VPN if you are using WPAD-style proxy autoconfiguration.

 

A possible workaround is to enable this setting in the registry:

 

Key:   HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\
Value: EnableLegacyAutoProxyFeatures
Type:  REG_DWORD
Data:  1

That will disable the security patch new behavior and let .NET components parse file:// auto-configuration URIs. Microsoft denotes that this should only be a temporary solution.

 

A better solution would be for F5 to update the way they are publishing the modified wpad.dat file locally, using a local embedded HTTP server in the VPN client would be my idea.