[7.450][BUG][FIXED] IPS false positive (SID 1325)

Since yesterday (or today) SSH connections are blocked by IPS rule 1325 (EXPLOIT ssh CRC32 overflow filler)

Source is an Ubuntu 8.04.2 (server version)
Destination (Mac OSX 10.4 / Ubuntu 9.04)

Everything up to date of course.

Installed pattern version: 9786

0 BarryG over 15 years ago

I've got people complaining about SSH not working to our 7.3x firewall... did this same pattern get pushed to 7.3?

Thanks,
Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 UrsWeiss over 15 years ago in reply to BarryG

I don't know if all Astaros uses the same patterns (but i think so).

Easiest way to find it out in your case is to make either an exception rule or fully disable the rule 1325. If it works after this change it's the same problem. Currently i have pattern version 9809 on my boxes, but could not test it yet.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BarryG over 15 years ago in reply to UrsWeiss

By the time I posted yesterday, our user was able to connect again, so either it's intermittent or a new pattern was pushed out.

Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ee-tra over 15 years ago in reply to BarryG

Will be checked if this rule is too sensitive.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 UrsWeiss over 15 years ago in reply to ee-tra

Seems to work again with:

Firmware version: 7.460
Pattern version: 9860

Thx
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Astaro Beta Bot over 15 years ago in reply to UrsWeiss

Astaro Beta Report
--------------------------------
Version: 7.450
Type: BUG
State: FIXED
Reporter: Whity
Contributor: 
MantisID: 10623
--------------------------------

0 ee-tra over 15 years ago in reply to Astaro Beta Bot

SID 1325 was removed from our pattern set because of too many false positives.
Thanks for reporting.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 fhudl over 15 years ago

Fixed in Version 7.500
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel