Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 13 replies
  • Subscribers 2 subscribers
  • Views 5914 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS false positive alert: blocks Symantec AV defs.

Scott_Klassen
Rule ID 17297 SPECIFIC-THREATS McAfee VirusScan on-access scanner long unicode filename handling buffer overflow attempt.
 
This blocks Symantec Endpoint Protection Manager from retreiving updated definitions through Live Update for disseminating to client systems. This is a new rule delivered on Wednesday in u2d-ips-7-193.i686.rpm. I would venture a guess that this is a new "bad" rule.  If you use Symantec Endpoint Protection, you'll want to disable this rule.


This thread was automatically locked due to age.
Parents
  • 0
    This rule began blocking normal virus definition updates for my Eset NOD32 anti-virus clients on October 13, at around 10am PST.
  • 0 in reply to Soong
    This rule began blocking normal virus definition updates for my Eset NOD32 anti-virus clients on October 13, at around 10am PST.


    Just curious, what version of ESET are you running?  I have 1 small business customer that is running Eset, and their updates do not trigger this rule -- they are running a slightly older version of Eset though.  I have seen some (but not all) customers affected that run Symantec AV though.  I have to say this rule should probably be removed from the distributed ruleset.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Reply
  • 0 in reply to Soong
    This rule began blocking normal virus definition updates for my Eset NOD32 anti-virus clients on October 13, at around 10am PST.


    Just curious, what version of ESET are you running?  I have 1 small business customer that is running Eset, and their updates do not trigger this rule -- they are running a slightly older version of Eset though.  I have seen some (but not all) customers affected that run Symantec AV though.  I have to say this rule should probably be removed from the distributed ruleset.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Children
Cookie Information Banner