This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS False Positive

Trying to retrieve javascript files from the same directory on a webserver. One file is allowed, one is blocked. What could be the reason? Here is the entry in the IPS log:

2010:10:06-11:07:32 pipe snort[27576]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="WEB-CLIENT Mozilla regular expression heap corruption attempt" group="320" srcip="10.3.0.30" dstip="10.1.1.6" proto="6" srcport="80" dstport="34337" sid="8443" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"

Is there a way to set the IPS to still monitor that server but allow that one file?

This thread was automatically locked due to age.

Parents

0 dspender over 14 years ago

How do I submit a false positive report? Open a support ticket? I would do so on snort.org but I'm not sure about the specifics they ask for:

Snort :: Submit a False Positive

Thank you!
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 dspender over 14 years ago

How do I submit a false positive report? Open a support ticket? I would do so on snort.org but I'm not sure about the specifics they ask for:

Snort :: Submit a False Positive

Thank you!
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 nalinfrancis over 13 years ago in reply to dspender

You can configure the IPS to generate the rule instead of generate and drop.
Cancel
Vote Up 0 Vote Down

Cancel