I don't understand why the firewall is saying the Citrix port (2513) is being connected (TCP) to my internal PC (192.168.11.13).
(According to Snort.org this is a TCP service.)
I don't have any DNATs for any ports around 2513; only eMule and BitTorrent on ports in the 60,000+ range.
Details about the intrusion alert:
Message........: EXPLOIT Citrix MetaFrame IMA buffer overflow attempt
Details........: www.snort.org/.../sigs.cgi
Time...........: 2009:03:06-19:59:47
Packet dropped.: yes
Priority.......: 1 (high)
Classification.: Attempted Administrator Privilege Gain
IP protocol....: 6 (TCP)
Source IP address: 60.241.35.207 (60-241-35-207.static.tpgi.com.au)
- www.dnsstuff.com/.../ptr.ch
- www.ripe.net/.../whois
- ws.arin.net/.../whois.pl
- cgi.apnic.net/.../whois.pl
Source port: 21022
Destination IP address: 192.168.11.13
- www.dnsstuff.com/.../ptr.ch
- www.ripe.net/.../whois
- ws.arin.net/.../whois.pl
- cgi.apnic.net/.../whois.pl
Destination port: 2513 (citrixadmin)
Anyone have any ideas?
Thanks,
Barry
This thread was automatically locked due to age.
