Threat detections of "Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)" in Windows server traffic

[Megawatt]

Anyone else seeing the following alerts:
tcp,alert,"gpt.ini",Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)

But this is being detected in traffic between 2 Windows server, so it doesn't make sense. Seems to be a false positive.

[Claw4609]

Hello,

I at least am not seeing this in our environment. Why does it being flagged between two servers lead to believe its a false positive?

If you want to create an exception you can do so from this and specify the specific IPs for exception as opposed to changing the action for the entire ID. How to create a vulnerability exception - Knowledge Base - Palo Alto Networks

Palo Vault of ID: https://threatvault.paloaltonetworks.com/?query=94951&type=

[Megawatt]

Because the source and destination are both Windows servers. This detection relates to a vulnerability in a Linux module (related to SMB I believe). 

[Claw4609]

Gotcha, would help if I read that closer. While it technically would be possible to run Ubuntu and those tools within a Windows server, it sounds like its probably a false positive. If thats the case you can submit a TAC case for them to look into the information and update the signature as needed. How to Submit a Vulnerability Signature False Positive - Knowledge Base - Palo Alto Networks

[Megawatt]

Tnx for your help. I'll start that process. 

[Megawatt]

 

Well, it seems that PA released an updated detection for this in the latest release (see attached image). Fingers crossed that this resolves it. I'll circle back here if I no longer see detections.