Re: Snort Alert[1:16482:8]

["Castle, Shane" <scastle () bouldercounty org>]

The info I have suggests that this rule has a very low or zero FP rate, indicating that you are mistaken and that there 
are really some IE 6 and 7 browsers on your net. I'd suggest following up on the IP addresses to see what is going on.

Of course, it's possible that the alerts are being generated from browsers outside your network if you do not have 
$EXTERNAL_NET and $HOME_NET set up properly.

-- 
Shane Castle
Data Security Mgr, Boulder County IT


-----Original Message-----
From: Kee, Scott [mailto:Scott.Kee () kellwood com] 
Sent: Tuesday, March 26, 2013 08:38
To: snort-users () lists sourceforge net
Subject: [Snort-users] Snort Alert[1:16482:8]

I recently installed Snort on my Ubuntu machine.    I am receiving a lot of 16482:8 alerts.  It is Microsoft ie 6 and 7 
vulnerability alert.

I don't have any users who are on using IE 6 or 7.  What is triggering this alert?  Is this safe to ignore?

 

Thanks

 

Scott


------------------------------------------------------------------------------
Own the Future-Intel® Level Up Game Demo Contest 2013
Rise to greatness in Intel's independent game demo contest.
Compete for recognition, cash, and the chance to get your game 
on Steam. $5K grand prize plus 10 genre and skill prizes. 
Submit your demo by 6/6/13. http://p.sf.net/sfu/intel_levelupd2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!