[7.450][BUG][FIXED] IMAP NAT interrupting?

I'm running 7.450 on my home test box, where my personal mail server is running.
I connect to that mailserver using IMAP, and since the installation of the 7.450, I can't seem to save items (like when sending a mail, the sent message is put in Sent Items; when using 'Save' it is put in Drafts, ...), as my Thunderbird keeps telling me over and over again 'sending login information','saving item in ...', 'sending login information'...

I keep getting a "IMAP append literal overflow attempt" in the Network Security overview tab...

With 7.4xx I had this message before, from time to time, but never had this behaviour like the above...

I tried disabling the Intrusion Protection for IMAP servers, and that seems to help a bit... but IPS is there for a reason, so I would like to enable it again...

Any other users having the same problems?

What do I need to send to the bugtrackers, so they get the whole picture, and solve this possible error?
Let me know, glad to help out.

Parents

0 BarryG over 15 years ago

Check your IPS log for any related entries.

Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BramKortleven over 15 years ago in reply to BarryG

I get tons and tons of these:

2009:06:09-17:27:32 -firewall- snort[20614]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="IMAP append literal overflow attempt" group="224" srcip="***.***.***.***" dstip="ser.ver.ip.add" proto="6" srcport="64933" dstport="143" sid="3065" class="Misc Attack" priority="2" generator="1" msgid="0"

I had these messages before, but didn't have these blocking access...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 BramKortleven over 15 years ago in reply to BarryG

I get tons and tons of these:

2009:06:09-17:27:32 -firewall- snort[20614]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="IMAP append literal overflow attempt" group="224" srcip="***.***.***.***" dstip="ser.ver.ip.add" proto="6" srcport="64933" dstport="143" sid="3065" class="Misc Attack" priority="2" generator="1" msgid="0"

I had these messages before, but didn't have these blocking access...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 wingman over 15 years ago in reply to BramKortleven

have you added your mailserver under the "stmp servers" withing the IPS?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BarryG over 15 years ago in reply to BramKortleven

Try disabling that rule; it sounds like it's a false positive.

Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BramKortleven over 15 years ago in reply to BarryG

I disabled the rule, and that stops the messages, and allows me to do stuff in IMAP, but I'd rather use IPS for IMAP...

I didn't have these messages or this behaviour blocking access with 7.402/7.403 or before...

What will adding my mailserver to the SMTP server list do to IMAP IPS scanning?
I added them anyway, as I recently started using direct SMTP traffic (before, I used pop3 pulls from my ISP mailboxes) and will see if this helps... I will enable the rule again to see if the problem re-occurs...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 dmzalarm over 15 years ago in reply to BramKortleven

Looking at this particular rule that is being triggered, I don't think it is relevant to you.

CVE - CVE-2004-1211 (under review)
Mercury Mail Transport System Command Handling Buffer Overflows - Secunia Advisories - Vulnerability Information - Secunia.com

It was meant for Mercury/Novell mail server which I am sure you are not running such a ancient product which is vulnerable.

I personally don't have a 7.4 running so i can't confirm if this sid was enabled in 7.4. However, I do feel snort is extra noisy on 7.5 and I have been getting all kinds of false + with it.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ee-tra over 15 years ago in reply to dmzalarm

SID 3065 will be disabled. Thanks for reporting.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 dmzalarm over 15 years ago in reply to ee-tra

Hi ee-tra,

just for my curiosity, how many snort rule is being used in 7.4 as compare to 7.5 beta? Sorry I no longer have a 7.4 machine that I can check.

Regards.

Claude
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ee-tra over 15 years ago in reply to dmzalarm

The amount almost of rules increased considerable.
In 7.4 we used around 4000 rules.
And now In 7.5 we actually have 6872 rules.
The number may vary since the rule file will be redistributed via the pattern up2date.

You can count the rules that snort actually uses via console:
# wc -l /var/sec/chroot-snort/etc/snort/rules/astaro.rules
6872 /var/sec/chroot-snort/etc/snort/rules/astaro.rules
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 dmzalarm over 15 years ago in reply to ee-tra

thks and one more question - apologize for asking so many questions!

Is it in the pipeline for astaro to provide an interface for users to choose which rule/sid they want to use according to their env and services they are trying to protect? Something like how pfsense delivers snort?

Most commercial firewall tends to mask the complexity of IDS rules from user but this introduces inflexibility and false positive since users are not able to customize IDS properly.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ee-tra over 15 years ago in reply to dmzalarm

For fine tuning you're offered 'Modified rules' in the Advanced tab.
There you can define the actions per SID.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 dmzalarm over 15 years ago in reply to ee-tra

thks, I was hoping for an interface to see all sid organized in categories and sid details - which makes it easier to configure multiple sid/categories at once.

Cheers and regards.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel