topic IMAP long tag anomaly in General Topics

IMAP long tag anomaly

Zewwy — Wed, 06 Jan 2016 17:06:14 GMT

I know this was kind of asked here, and I was wondering if the best option would be to create a rule like the one mentioned in this post..

https://live.paloaltonetworks.com/t5/General-Topics/SMTP-long-MAIL-anomaly-Vulnerability-30392/m-p/2327#M1718

Since I am getting these almost everyday, and they seem to be always from one user account, and they happen to use gmail.

I also use gmail but I never seem to see my account as the "attacker" which I'm not sure why his account keep showing up as the attacker.

Should I just create the block rule and see if his email still works? He says he uses teh Windows Mail app with all gmail accounts.

Re: IMAP long tag anomaly

Zewwy — Mon, 07 Mar 2016 19:50:14 GMT

A very smart network engineer I know informed me this is due to the way google changed the way their email system worked, and is caused when users who particularly use gmail with multiple folders will cause this Threat to be triggered.

He provided one of two options to help correct it.

1) get my colleague to clean up his gmail. reduce folder, etc (not likly to happen)

2) adjust the profile monitor and change it so that particular vulnerability isn't alerted on, this leave it open to exploitation.

Both options are not great, thus at this point I'll simply have to ingore in.. *Sticks head in the sand*

Thanks for all the replies *Cough none*