Network Protection: Firewall, NAT, QoS, & IPS IPS alert 45255

UTM Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 2 replies
Subscribers 5 subscribers
Views 4329 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS alert 45255

SteveHart over 7 years ago

I'm getting a couple of IPS alerts daily

"SERVER-SAMBA Samba tree connect andx memory corruption attempt
Details........: https://www.snort.org/search?query=45255"

It looks like they updated the definition for this three times yesterday. Is anyone else seeing these?

This thread was automatically locked due to age.

0 sys8dmin over 7 years ago

Yes, I have the same event logged on Tuesday 23rd January:

TOP10 Attacks Rules
Total attack events: 1
Top Rule ID Rule Name Group Events %
1 45255 SERVER-SAMBA Samba tree connect andx memory corruption attempt Malware 1 100.00%
Cancel
Vote Up 0 Vote Down

Cancel
0 Joel Esler over 7 years ago

Actually, I think the update documentation is just loaded three times. The rule has only been updated one time (rev:2)
Cancel
Vote Up 0 Vote Down

Cancel