This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS false positive

Hello,

When I try to acces KLACK - Das TV-Magazin im Internet, I get the following IPS hit:

2009:11:04-00:06:22 astaro snort[23863]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="WEB-CLIENT HTML DOM invalid DHTML element creation attempt" group="320" srcip="78.138.80.125" dstip="192.168.12.102" proto="6" srcport="80" dstport="1131" sid="3549" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"

Is it a false positive or are there some threats on that site?

Thanks in advance,

Dino

This thread was automatically locked due to age.

Parents

0 BarryG over 15 years ago

Hi,
SnortID.com - Search for SNORT ID's - Snort is a registered trademark of Sourcefire, Inc

says this is a potential IE6 exploit, but false positives are possible.
If you're not running IE6, or are patched, you could exclude SID 3549 in Intrusion Protection - Advanced.

Barry
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BarryG over 15 years ago

Hi,
SnortID.com - Search for SNORT ID's - Snort is a registered trademark of Sourcefire, Inc

says this is a potential IE6 exploit, but false positives are possible.
If you're not running IE6, or are patched, you could exclude SID 3549 in Intrusion Protection - Advanced.

Barry
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data