Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 3 subscribers
  • Views 2353 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Endpoint won't update... thinks it's an IPS attack...

Amodin
[8-)]

So I put Endpoint on my machine I just rebuilt and loaded Windows 8.1 on, and cannot update Endpoint.  I look in my logs, and found this gem:

2014:02:19-14:34:44 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49561" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:34:44 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49561" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:20 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49600" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:20 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49600" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:54 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49609" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:54 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49609" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:11 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49556" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:11 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49556" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:42 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49591" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:42 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49591" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0" 


The UTM thinks it's an IPS attack, and refuses to let the endpoint update.

Any ideas on this one?  [:)]  I just updated to 9.109 before doing this.


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Amodin
    Thanks Amodin,
    saved my life. Our CEO already wanted to throw the whole appliance out of the window.
    Besides the problem with certificate check not working anymore for many many subdomains and of popular websites this was a bit too much trouble this week... [:(]