Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 2 subscribers
  • Views 2318 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ID 11669 False Positive or not?

Scott_Klassen
For the past week or so, been getting frequent alerts for SPECIFIC-THREATS Eudora 250 command response buffer overflow.
 
The rule is:
flow:established, to_client
content:"250"
pcre:"/^250.*[^\x20-\x7E\t\x0D\x0A]/sm"
classtype:attempted-user 
 
The alerts show that the messages which trigger the alert are flowing from my astaro box to my internal mail server which is not particularly helpful in finding the specific messages.  
 
Is this alert saying that somebody is sending messages to one of my users with a version of Eudora that is missing a patch?  Or is this a false positive that doesn't need to be worried about?  Anybody else been getting any of these recently?


This thread was automatically locked due to age.
Parents
  • 0
    Likely to be a false positive... I've noted this event on several customer firewalls, and have disabled it (none of them use Eudora)... pretty darn sure these were false positives as the IPS reported the source as Astaro's SMTP proxy with the destination being their internal Exchange Server.  THis appears to be a rule that is easy to trigger with legit traffic.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Reply
  • 0
    Likely to be a false positive... I've noted this event on several customer firewalls, and have disabled it (none of them use Eudora)... pretty darn sure these were false positives as the IPS reported the source as Astaro's SMTP proxy with the destination being their internal Exchange Server.  THis appears to be a rule that is easy to trigger with legit traffic.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Children
Cookie Information Banner