False Positive ?

Hi Roman,

Please post a copy of your IPS settings.

Ian

https://www.snort.org/rule-docs/1-32998

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2850

As it only affected the Sophos Web Appliance Interface (SWA), i would guess false positive. 

This policy is used ;) Im also thinking thats a F/P. But i just wanna to be somehow sure. Weird is that it points to a Facebook ip addr with "Sophos Web Appliance" - how is this combined :)

IPS will inspect for all loaded Snort rules. 

If some traffic matches, it will alert and block this traffic. 

https://en.wikipedia.org/wiki/Intrusion_detection_system#Signature-based

Maybe somebody within Facebook developed a application, which uses similar traffic. 

A big Thanks for your explanation and help ;) cheers!

Hi all,

We get a tone of Alerts from IPS with "Sophos Web Appliance arbitrary command execution attempt" when accessing New FACEBOOK Dark Mode.

How to react to this messages ? Is there an 'Acknowledge' check so that this specific alert will not be received ? ( we're receiving all alerts on e-mail and it's getting annoying )

LOG message ALERT:

Facebook Dark Mode: ->https://www.facebook.com/facebookapp/videos/278999813137341/ 

For now, IPS settings for the Web Rule is set to : LanToWanGeneral (default one)

Hi all,

We get a tone of Alerts from IPS with "Sophos Web Appliance arbitrary command execution attempt" when accessing New FACEBOOK Dark Mode.

How to react to this messages ? Is there an 'Acknowledge' check so that this specific alert will not be received ? ( we're receiving all alerts on e-mail and it's getting annoying )

LOG message ALERT:

Facebook Dark Mode: ->https://www.facebook.com/facebookapp/videos/278999813137341/ 

For now, IPS settings for the Web Rule is set to : LanToWanGeneral (default one)