Mac Mail, GMail and vulnerability CVE-2004-2501

n.flanagan — Thu, 30 Jun 2011 08:59:41 GMT

On a PA 2020 running 4.03, the threat log is filled with clients triggering alerts for MailEnable IMAP Server Long Tag anomaly (CVE-2004-2501), rated "high".They are all in fact Mac Mail clients trying to talk IMAP to GMail servers on port 993. On the face of it they must all be false positives. SSL decryption is being used. Could anyone give any idea why Long Tag anomalies are being detected?

Neil Flanagan

Re: Mac Mail, GMail and vulnerability CVE-2004-2501

swhyte — Mon, 04 Jul 2011 14:21:10 GMT

Hello Neil,

if you can get a packet capture of this traffic, then you can open a case with support and they can refer this to the content team to verify if this is indeed a false positive.

thanks,

Stephen

topic Mac Mail, GMail and vulnerability CVE-2004-2501 in General Topics

Mac Mail, GMail and vulnerability CVE-2004-2501

Re: Mac Mail, GMail and vulnerability CVE-2004-2501