Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SERVER-OTHER Flexera FlexNet Publisher stack buffer overflow attempt

After the last IPS update, I keep getting this triggered from and to my Veeam Backup server:

Intrusion Prevention Alert

An intrusion has been detected. The packet has been dropped automatically.
You can toggle this rule between "drop" and "alert only" in WebAdmin.

Details about the intrusion alert:

Message........: SERVER-OTHER Flexera FlexNet Publisher stack buffer overflow attempt
Details........: https://www.snort.org/search?query=38246
Time...........: 2016-03-27 04:24:04
Packet dropped.: yes
Priority.......: high
Classification.: Attempted Administrator Privilege Gain
IP protocol....: 6 (TCP)

Source IP address: 192.168.4.19 
Source port: 51783
Destination IP address: 192.168.110.22 
Destination port: 2501 (rtsclient)
        
-- 
System Uptime      : 9 days 11 hours 31 minutes
System Load        : 0.23
System Version     : Sophos UTM 9.400-9

Please refer to the manual for detailed instructions.

Intrusion Prevention Alert

An intrusion has been detected. The packet has been dropped automatically.
You can toggle this rule between "drop" and "alert only" in WebAdmin.

Details about the intrusion alert:

Message........: SERVER-OTHER Flexera FlexNet Publisher stack buffer overflow attempt
Details........: https://www.snort.org/search?query=38247
Time...........: 2016-03-26 23:03:00
Packet dropped.: yes
Priority.......: high
Classification.: Attempted Administrator Privilege Gain
IP protocol....: 6 (TCP)

Source IP address: 192.168.10.30 
Source port: 64442
Destination IP address: 192.168.110.10 
Destination port: 2500 (rtsserv)
        
-- 
System Uptime      : 9 days 7 hours 10 minutes
System Load        : 0.14
System Version     : Sophos UTM 9.400-9

Please refer to the manual for detailed instructions.

I definately NOT have Flex Licensing installed..

Anyone seeing this?



This thread was automatically locked due to age.
Parents
  • Did anyone find a solutions to this?

    I'm getting exactly the same messages for a DPM backup running over a VPN.

    It's strange as it only happens with a volume/system recovery backup and not with the SQL backups that run on the same servers.

    I'm running v9.355. What is everyone else on?

    I've got a support call open with Sophos, will post if anything comes of it.

Reply
  • Did anyone find a solutions to this?

    I'm getting exactly the same messages for a DPM backup running over a VPN.

    It's strange as it only happens with a volume/system recovery backup and not with the SQL backups that run on the same servers.

    I'm running v9.355. What is everyone else on?

    I've got a support call open with Sophos, will post if anything comes of it.

Children
No Data