ips signature 7067 issue?

[wgorman]

Is anyone else experiencing issues with this IPS signature 7067/0, Microsoft Internet Explorer Memory Corruption alert ?

The signature version update is 899.0 and it was released yesterday afternoon (12\8\15).

We have received over 5000 hits from external addresses.

Is this a false\positive event?

-willG

[mcvosi]

Seeing the same.

[androdri]

Hello willG;

This is a most likely a false positive,  We will take another look at the signature and see if it possible to increase the fidelity of the signature,  if not we will take the steps to retire it.

Thank you for you feedback

Andy Rodriguez

Cisco Legacy IPS Signature Development

[gm-douglas]

Any update on this as I am seeing the same thing?

[androdri · Accepted solution]

We have determined it is a false positive,  the signature will be retired in the next release.

[siddiquiasad]

experiencing the same !!!

BR,

Asad Siddiqui

[isadmin]

When is the next release scheduled?

[androdri]

The signature was retired in S900.  The release was posted on 12/10/2015.