Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SERVER-OTHER Flexera FlexNet Publisher stack buffer overflow attempt

After the last IPS update, I keep getting this triggered from and to my Veeam Backup server:

Intrusion Prevention Alert

An intrusion has been detected. The packet has been dropped automatically.
You can toggle this rule between "drop" and "alert only" in WebAdmin.

Details about the intrusion alert:

Message........: SERVER-OTHER Flexera FlexNet Publisher stack buffer overflow attempt
Details........: https://www.snort.org/search?query=38246
Time...........: 2016-03-27 04:24:04
Packet dropped.: yes
Priority.......: high
Classification.: Attempted Administrator Privilege Gain
IP protocol....: 6 (TCP)

Source IP address: 192.168.4.19 
Source port: 51783
Destination IP address: 192.168.110.22 
Destination port: 2501 (rtsclient)
        
-- 
System Uptime      : 9 days 11 hours 31 minutes
System Load        : 0.23
System Version     : Sophos UTM 9.400-9

Please refer to the manual for detailed instructions.

Intrusion Prevention Alert

An intrusion has been detected. The packet has been dropped automatically.
You can toggle this rule between "drop" and "alert only" in WebAdmin.

Details about the intrusion alert:

Message........: SERVER-OTHER Flexera FlexNet Publisher stack buffer overflow attempt
Details........: https://www.snort.org/search?query=38247
Time...........: 2016-03-26 23:03:00
Packet dropped.: yes
Priority.......: high
Classification.: Attempted Administrator Privilege Gain
IP protocol....: 6 (TCP)

Source IP address: 192.168.10.30 
Source port: 64442
Destination IP address: 192.168.110.10 
Destination port: 2500 (rtsserv)
        
-- 
System Uptime      : 9 days 7 hours 10 minutes
System Load        : 0.14
System Version     : Sophos UTM 9.400-9

Please refer to the manual for detailed instructions.

I definately NOT have Flex Licensing installed..

Anyone seeing this?



This thread was automatically locked due to age.