Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 3249 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS blocking Ticketmaster javascript

wstrucke
Our ASG625 running 7.508 is blocking javascript from ticketmaster with the rule:

WEB-CLIENT obfuscated javascript excessive fromCharCode - potential attack

Is anyone else seeing this?  Is it from a recent pattern update or an error?  I don't want to disable this particular rule or whitelist any hosts at this point.


This thread was automatically locked due to age.
Parents
  • 0
    I am having the same problem using asg 8.102. Same error.
  • 0 in reply to joesiciliano
    I am having the same problem using asg 8.102. Same error.


    2011:04:18-08:27:45 mvos-fw snort[7968]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="WEB-CLIENT obfuscated javascript excessive fromCharCode - potential attack" group="320" srcip="65.222.174.17" dstip="192.168.115.38" proto="6" srcport="80" dstport="54949" sid="15362" class="Misc activity" priority="3"  generator="1" msgid="0"
Reply
  • 0 in reply to joesiciliano
    I am having the same problem using asg 8.102. Same error.


    2011:04:18-08:27:45 mvos-fw snort[7968]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="WEB-CLIENT obfuscated javascript excessive fromCharCode - potential attack" group="320" srcip="65.222.174.17" dstip="192.168.115.38" proto="6" srcport="80" dstport="54949" sid="15362" class="Misc activity" priority="3"  generator="1" msgid="0"
Children
No Data