topic Re: Lot of 'SMTP Long MAIL anomaly Vulnerability' critical warnings in General Topics

Lot of 'SMTP Long MAIL anomaly Vulnerability' critical warnings

RIF — Fri, 30 May 2014 13:53:16 GMT

Sometimes we get a lot of 'SMTP Long MAIL anomaly Vulnerability' critical e-mail warnings from the PaloAlto PA-500.

PA-500 is filling up our mailbox with this warnings until we block the IP-range.

Does anyone has a suggestion how to moderate this warning.

Re: Lot of 'SMTP Long MAIL anomaly Vulnerability' critical warnings

HULK — Fri, 30 May 2014 15:50:00 GMT

Hello RIF,

This is triggered when an argument to a MAIL command to an SMTP server is overly long (304 bytes). This triggers a buffer overflow leading to a DOS and/or possible remote code execution. Could you please let me know which Application and threat version is currently installed on your PAN firewall...?

Thanks

Re: Lot of 'SMTP Long MAIL anomaly Vulnerability' critical warnings

RIF — Mon, 02 Jun 2014 06:43:43 GMT

Thanx HULK.

The kind of thread is clear but the problem is that the PA-500 sends us a mail alert for every trigger.

The attacker is sending us every couple of minutes a 'wrong' mail command from a different IP-Address in the same IP- rangs.

Is it possible to create some kind of threshold?