Threat detections of "Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)" in Windows server traffic

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Threat detections of "Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)" in Windows server traffic

L1 Bithead

Anyone else seeing the following alerts:
tcp
,alert,"gpt.ini",Canonical ksmbd-tools ksmbd.mountd ndrwritebytes Heap Buffer Overflow Vulnerability(94951)

 

But this is being detected in traffic between 2 Windows server, so it doesn't make sense. Seems to be a false positive.

 

 

5 REPLIES 5

Cyber Elite
Cyber Elite

Hello,

 

I at least am not seeing this in our environment. Why does it being flagged between two servers lead to believe its a false positive?

 

If you want to create an exception you can do so from this and specify the specific IPs for exception as opposed to changing the action for the entire ID. How to create a vulnerability exception - Knowledge Base - Palo Alto Networks

 

Palo Vault of ID: https://threatvault.paloaltonetworks.com/?query=94951&type=

Because the source and destination are both Windows servers. This detection relates to a vulnerability in a Linux module (related to SMB I believe). 

Gotcha, would help if I read that closer. While it technically would be possible to run Ubuntu and those tools within a Windows server, it sounds like its probably a false positive. If thats the case you can submit a TAC case for them to look into the information and update the signature as needed. How to Submit a Vulnerability Signature False Positive - Knowledge Base - Palo Alto Networks

Tnx for your help. I'll start that process. 

Well, it seems that PA released an updated detection for this in the latest release (see attached image). Fingers crossed that this resolves it. I'll circle back here if I no longer see detections. 

IMG_5853.jpeg

  • 2755 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!