topic Re: Threat detections of "Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)" in Windows server traf in Next-Generation Firewall Discussions

Threat detections of "Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)" in Windows server traffic

Megawatt — Fri, 08 Mar 2024 14:01:19 GMT

Anyone else seeing the following alerts:
tcp,alert,"gpt.ini",Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)

But this is being detected in traffic between 2 Windows server, so it doesn't make sense. Seems to be a false positive.

Re: Threat detections of "Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)" in Windows server traf

Claw4609 — Fri, 08 Mar 2024 15:55:35 GMT

Hello,

I at least am not seeing this in our environment. Why does it being flagged between two servers lead to believe its a false positive?

If you want to create an exception you can do so from this and specify the specific IPs for exception as opposed to changing the action for the entire ID. How to create a vulnerability exception - Knowledge Base - Palo Alto Networks

Palo Vault of ID: https://threatvault.paloaltonetworks.com/?query=94951&type=

Re: Threat detections of "Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)" in Windows server traf

Megawatt — Fri, 08 Mar 2024 17:01:50 GMT

Because the source and destination are both Windows servers. This detection relates to a vulnerability in a Linux module (related to SMB I believe).

Re: Threat detections of "Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)" in Windows server traf

Claw4609 — Fri, 08 Mar 2024 17:20:21 GMT

Gotcha, would help if I read that closer. While it technically would be possible to run Ubuntu and those tools within a Windows server, it sounds like its probably a false positive. If thats the case you can submit a TAC case for them to look into the information and update the signature as needed. How to Submit a Vulnerability Signature False Positive - Knowledge Base - Palo Alto Networks

Re: Threat detections of "Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)" in Windows server traf

Megawatt — Fri, 08 Mar 2024 21:00:25 GMT

Tnx for your help. I'll start that process.

Re: Threat detections of "Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)" in Windows server traf

Megawatt — Sun, 10 Mar 2024 00:50:40 GMT

Well, it seems that PA released an updated detection for this in the latest release (see attached image). Fingers crossed that this resolves it. I'll circle back here if I no longer see detections.