topic Sig 3550 FPs - POP buffer overflow in Network Security

Sig 3550 FPs - POP buffer overflow

jkell — Sun, 10 Mar 2019 10:13:39 GMT

Getting numerous 3550 alerts, apparently embedded text within a POP mail item (not command text).

Re: Sig 3550 FPs - POP buffer overflow

wsulym — Mon, 18 Sep 2006 12:39:11 GMT

Thanks for bringing this to our attention ... This is an old sig, written before my time and at first glance it seems that it should be a username overflow. I'll look into it and adjust it as needed.

Thanks again.

Re: Sig 3550 FPs - POP buffer overflow

wsulym — Thu, 26 Oct 2006 18:00:57 GMT

3550 is from olden days and was written as a generic overflow sig to a POP daemon. 3728-0 and 3729-0 tie the overflows to usernames and passwords, but this one is a catch-all. I'm just changing the desciption a bit and adding a benign trigger. For the time being, we're just going to leave this as a generic overflow, not linked to any particular command.