[7.460][DUPE][FIXED] Intrusion Protection - Bad Link

My ASG sent me an e-mail Intrusion Protection Alert as follows:

----------

Subject: [bgiles.homeip.net][CRIT-852] Intrusion Protection Alert (Packet dropped)

Intrusion Protection Alert

An intrusion has been detected. The packet has been dropped automatically.
You can toggle this rule between "drop" and "alert only" in WebAdmin.

Details about the intrusion alert:

Message........: WEB-CLIENT Malformed PNG detected sRGB overflow attempt
Details........: http://www.snort.org/pub-bin/sigs.cgi?sid=6692
Time...........: 2009:06:22-02:10:27
Packet dropped.: yes
Priority.......: 1 (high)
Classification.: Attempted User Privilege Gain
IP protocol....: 6 (TCP)

----------

The problem is the web link to snort.com in the "Details" line. When I attempted to go to that page for more information, I get a "The page you're looking for isn't here" error message.

I also get the same results for this one:

Message........: WEB-CLIENT Malformed PNG detected iCCP overflow attempt
Details........: http://www.snort.org/pub-bin/sigs.cgi?sid=6690

0 BAlfson over 16 years ago

Yes, those links have been broken for quite awhile. Now would be a good time to clean that up.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 nitehawk over 16 years ago

This was earlier reported here: https://community.sophos.com/products/unified-threat-management/astaroorg/f/98/t/67720

But thanks anyway.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 16 years ago in reply to nitehawk

For those that are interested; Snort.org has recently rehashed their website, and the old DB is not available anymore... they haven't even issued a public commit date for bringing that functionality back. In the meantime, try looking up Snort SIDs at SnortID.com - Search for SNORT ID's - Snort is a registered trademark of Sourcefire, Inc (Not my site or anything, but it's handy)...

Also, Astaro may want to consider removing the DNSstuff links from these notification emails; those links are no longer valid either.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 16 years ago in reply to BrucekConvergent

Also, Astaro may want to consider removing the DNSstuff links from these notification emails

Yes I was noticing that the other day. Although the links are not broken per se (no four oh fours) but the functionality is gone.Maybe the script needs a little rework since dnsstuff.com/tools works manually.

A query like this
dnsstuff.com/tools/whois/?ip=4.2.2.1&server
works fine but the default astaro
dnsstuff.com/tools/ptr.ch?ip=4.2.2.1
is broken.

There has to be a better way instead of astaro relying on outside links period. Home users although grateful, are not the only ones running this. An enterprise class firewall costing a lot of money directing you to unaffiliated websites for reports is just not professional. Come on astaro, it doesn't take much to run a whois server or a server pointing to your own snort rules with explanation for that matter.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Astaro Beta Bot over 16 years ago in reply to Billybob

Astaro Beta Report
--------------------------------
Version: 7.460
Type: DUPE
State: FIXED
Reporter: bgiles
Contributor: 
MantisID: 10610
--------------------------------

0 BrucekConvergent over 16 years ago in reply to Billybob

There has to be a better way instead of astaro relying on outside links period. Home users although grateful, are not the only ones running this. An enterprise class firewall costing a lot of money directing you to unaffiliated websites for reports is just not professional. Come on astaro, it doesn't take much to run a whois server or a server pointing to your own snort rules with explanation for that matter.

You have a bit of a point there, it wouldn't be a bad idea for them to host their own rules lookup db, whois, etc.... or build the DB and functionality into the product.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel