This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[INFO-115] Snort restart today

Anyone else noticing multiple units getting snort restarts today (2014-11-17).
We've had three different UTMs report multiple snort restarts this morning.

[INFO-115] Snort not running - restarted
Snort not running - restarted

Also noticing some new IPS hits on one of these units;
(smtp) Attempted response buffer overflow: ???? chars

Regards,
Thomas

This thread was automatically locked due to age.

Parents

0 mdallagi over 10 years ago

Hi all,

any feedback about the new pattern?
Does it really work?
Cancel
Vote Up 0 Vote Down

Cancel
0 guawhitehawk over 10 years ago in reply to mdallagi

Hi,

just tried it with Pattern Version: 70549 on 9.300-5. It still does not work (for us). [:(]
But iam also in contact with Sophos about that issue right now. I'll report back.
Cancel
Vote Up 0 Vote Down

Cancel
0 thomas_brewster over 10 years ago in reply to guawhitehawk

Per this morning 11/21/2014 the IPS was still causing significant slowdowns. I just got word from some other support people that the root of the problem seems to be another set of bad (corrupt) definitions pushed down to snort.

There is an expected update to fix this to be "released any time now". And I gather this affected not just Sophos UTMs, but for other products using snort as well. (Fortinet was mentioned)
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 thomas_brewster over 10 years ago in reply to guawhitehawk

Per this morning 11/21/2014 the IPS was still causing significant slowdowns. I just got word from some other support people that the root of the problem seems to be another set of bad (corrupt) definitions pushed down to snort.

There is an expected update to fix this to be "released any time now". And I gather this affected not just Sophos UTMs, but for other products using snort as well. (Fortinet was mentioned)
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data