Mac Mail, GMail and vulnerability CVE-2004-2501

[n.flanagan]

On a PA 2020 running 4.03, the threat log is filled with clients triggering alerts for MailEnable IMAP Server Long Tag anomaly (CVE-2004-2501), rated "high".They are all in fact Mac Mail clients trying to talk IMAP to GMail servers on port 993. On the face of it they must all be false positives. SSL decryption is being used. Could anyone give any idea why Long Tag anomalies are being detected?

Neil Flanagan

[swhyte]

Hello Neil,

if you can get a packet capture of this traffic, then you can open a case with support and they can refer this to the content team to verify if this is indeed a false positive.

thanks,

Stephen