[7.480][BUG][FIXED] IPS Intermitently blocking POP email

The problem itermitently happens when recieveing POP email through Outlook 2003 and typically occurs with large abounts of messages or mesages with large attachments. Symptoms are mail transfer speeds drop from 100's of KB/s to 50 bytes/s. In the case of below it was triggered by an email with jpg images attached however in the past mail without attachements of any type.

2009:08:18-10:36:01 astaropss snort[23675]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="SHELLCODE base64 x86 NOOP" group="120" srcip="2xx.1xx.xx.xx" dstip="1xx.1xx.1xx.2xx" proto="6" srcport="110" dstport="1086" sid="12800" class="Executable code was detected" priority="1" generator="1" msgid="0

I'm not sure what more information you need, but this config has 2 internet connections configured in multipath mode.

This problem has been happening since the first beta and didn't happened with 7.3

Parents

0 ee-tra over 15 years ago

sid="12800" is excluded now with ips pattern 7.143. Thank you for reporting.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PremiereSystems over 15 years ago in reply to ee-tra

sid="12800" is excluded now with ips pattern 7.143. Thank you for reporting.

Thanks, that's good to hear I'll renable IPS and see how it goes.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PremiereSystems over 15 years ago in reply to PremiereSystems

As before POP email is being blocked this time with only one message with no attachment. Below is part of the log.

009:08:25-08:14:22 astaropss snort[14022]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="SHELLCODE base64 x86 NOOP" group="120" srcip="216.***.XX.XX" dstip="192.***.***.***" proto="6" srcport="110" dstport="1616" sid="12798" class="Executable code was detected" priority="1" generator="1" msgid="0

Any help would be appreciated.

Thanks,

-Steve
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ee-tra over 15 years ago in reply to PremiereSystems

sid="12798" will be checked.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to ee-tra

I highly recommend that Astaro split out the category of "Shellcode" rules in the IPS (make it it's own checkbox)... shellcode rules are prone to false positives.

ETA, every Snort install I've run across (just about) has the Shellcode rules disabled... they are troublesome to be sure. If we can at least enable / disable them as a category group, that would be a very good idea.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Monarch over 15 years ago in reply to BrucekConvergent

I highly recommend that Astaro split out the category of "Shellcode" rules in the IPS (make it it's own checkbox)... shellcode rules are prone to false positives.

I really advocate for this, too! When I don't disable the shellcode rule, I receive excessive false alarms (already thought about opening an extra thread), which seem to be connected to my DynDNS updater querying for the external IP address.

Regards,
Bastian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Monarch over 15 years ago in reply to BrucekConvergent

I highly recommend that Astaro split out the category of "Shellcode" rules in the IPS (make it it's own checkbox)... shellcode rules are prone to false positives.

I really advocate for this, too! When I don't disable the shellcode rule, I receive excessive false alarms (already thought about opening an extra thread), which seem to be connected to my DynDNS updater querying for the external IP address.

Regards,
Bastian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data