Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 3 subscribers
  • Views 2328 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Endpoint won't update... thinks it's an IPS attack...

Amodin
[8-)]

So I put Endpoint on my machine I just rebuilt and loaded Windows 8.1 on, and cannot update Endpoint.  I look in my logs, and found this gem:

2014:02:19-14:34:44 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49561" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:34:44 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49561" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:20 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49600" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:20 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49600" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:54 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49609" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:54 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49609" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:11 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49556" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:11 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49556" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:42 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49591" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:42 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49591" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0" 


The UTM thinks it's an IPS attack, and refuses to let the endpoint update.

Any ideas on this one?  [:)]  I just updated to 9.109 before doing this.


This thread was automatically locked due to age.
Parents
  • 0
    Found the problem.  Snort has two rules that have to be disabled.  29465, 29466 in order for this to work.  :\

    XG 19.5 GA 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | GB Ethernet x5

  • 0 in reply to Amodin
    Thanks Amodin,
    saved my life. Our CEO already wanted to throw the whole appliance out of the window.
    Besides the problem with certificate check not working anymore for many many subdomains and of popular websites this was a bit too much trouble this week... [:(]
Reply
  • 0 in reply to Amodin
    Thanks Amodin,
    saved my life. Our CEO already wanted to throw the whole appliance out of the window.
    Besides the problem with certificate check not working anymore for many many subdomains and of popular websites this was a bit too much trouble this week... [:(]
Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?