topic Re: sendmail data header overflow in Network Security

sendmail data header overflow

tjcorlando — Sun, 10 Mar 2019 10:55:41 GMT

I am getting Alerts related to this Sig ID (3115). This is a Microsoft shop with an Exchange 2003 email server. Is there any risk? Should I be concerned about this Alert?

Re: sendmail data header overflow

mhellman — Thu, 03 Jan 2008 22:03:08 GMT

no.

1) it's older than the hills

2) has known false positives (see: http://tools.cisco.com/MySDN/Intelligence/viewSignature.x?signatureId=3115&signatureSubId=0)

3) you don't run sendmail

as of s311, this is by default disabled and retired. did you "unretire" it or are you running an older signature set?

Re: sendmail data header overflow

tjcorlando — Thu, 03 Jan 2008 22:20:53 GMT

Thanks for the information. I must have an old sig set; I thought I was current as of a few weeks ago. I'll update the sig set and confirm that it disables this Alert.

Re: sendmail data header overflow

mhellman — Thu, 03 Jan 2008 22:41:30 GMT

I may have spoken too soon. While 3115-0 is default disabled/retired, 3115-3 is not. The former has vendor acknowledged false positives. The latter is just as old though and if you don't run sendmail I would recommend disable/retire.

see: http://tools.cisco.com/MySDN/Intelligence/viewSignature.x?signatureId=3115&signatureSubId=3