How to Fix SSH_EVENT_RESPOVERFLOW on FMC

[Garry Cooper]

I am trying to transfer legitimate traffic using openssh verison 8.1 and the IPS triggers SSH_EVENT_RESPOVERFLOW.

What is the best option to fix this, as I am reluctant to disable rule, and whitelisting does not work

[Ilkin]

The SSH_EVENT_RESPOVERFLOW could be shown because the SSH preprocessor is enabled that also has the option Detect Challenge-Response Buffer Overflow Attack enabled. From the documentation:

Detect Challenge-Response Buffer Overflow Attack
Enables or disables detecting the Challenge-Response Buffer Overflow exploit.

You can enable rule 128:1 to generate events and, in an inline deployment, drop offending packets for this option. Note that an SFTP session can occasionally trigger rule 128:1.

According to the documentation for SFTP traffic, it seems to be expected.  Is there SFTP traffic going through Snort? 

[Garry Cooper]

Thanks for the reply, I have pushed this back to the vendors, as I suspect they could be using an old version of openssh.

Will update this once I know