Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 3 subscribers
  • Views 2328 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Endpoint won't update... thinks it's an IPS attack...

Amodin
[8-)]

So I put Endpoint on my machine I just rebuilt and loaded Windows 8.1 on, and cannot update Endpoint.  I look in my logs, and found this gem:

2014:02:19-14:34:44 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49561" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:34:44 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49561" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:20 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49600" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:20 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49600" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:54 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49609" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:38:54 amodin snort[17740]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.232.171" dstip="192.168.20.101" proto="6" srcport="80" dstport="49609" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:11 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49556" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:11 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49556" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:42 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49591" sid="29466" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2014:02:19-14:52:42 amodin snort[17736]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt" group="500" srcip="23.77.233.48" dstip="192.168.20.101" proto="6" srcport="80" dstport="49591" sid="29465" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0" 


The UTM thinks it's an IPS attack, and refuses to let the endpoint update.

Any ideas on this one?  [:)]  I just updated to 9.109 before doing this.


This thread was automatically locked due to age.
Parents Reply Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?