Is the text of the EOS really correct ?   Software maintenance support for 2.3 software releases end on September 17 th 2019. No patches or maintenance releases will be provided for ISE 2.3 releases after that date. Starting March 17 th 2019 only sev1 and security vulnerability issues will be addressed.   Shouldn't we read Sep17th as well for the second point? ... View more

If you are seeing that signature firing, that means you or your users are browsing a web page including more than 2000 script action handlers. That is possible but shouldn't be so common. I'd suggest to increase the Event Count value to something bigger. The risk in this case would be to miss a real attack. ... View more

Go to Configuration | Signature Definition | Signature Configuration Click on the "Add" button. -> New popup with the signature parameters Select String TCP as an engine ->New parameters appear Configure "Regex String" and "Service Ports" as mentionned previously. Click "OK" Click "APPLY" ... View more

Even if this has particularly caught the media attention, this is another of those mass-mailer worms. As you may know, for this kind of threat we are relying on our partnership with TrendMicro to decide if and when to write a signature. So far this threat is still rated as "low" on their website. We don't currently plan to release a signature for this untill their rating has been increased to medium or high. In the meantime you can use the following custom signature to catch WORM_GREW.A also known as W32.Blackmal.E@mm, W32/Kapser.A@mm, W32/MyWife, Win32/Blackmal.F: Engine: String.TCP Service Port: 25 Regex String : \x6d\x41\x70\x4d\x6a\x74\x64\x4e\x45\x51\x78\x4a\x7a\x49\x6a\x53\x79\x46\x49\x4f\x44\x30\x4e\x43\x6b\x31\x4b\x57\x6c\x51\x70\x4e ... View more

No,this is not a 5.x only signature. There is a 4.x version as well. 5477.2 - Possible Heap Payload Construction ... View more

This is covered by signature 5477-2 that was released last monday in the S202 signature update. ... View more

That is detected by the 5477.2 signature released in S202. ... View more

This upgrade is not failing because of a memory issue but due to a lack of free disk space. From your "show ver", it looks like you still have plenty of space but that may be misleading. Could you post the output of "df -k" captured from the service account? Thanks, JF ... View more

Hi Darin, This signature is indeed firing because the following part is included into the XML file being posted: ','')); echo ..'______BEGIN______'; I'm not too sure if this is legitimate or not in your case, but that definitely looks like a code injection! It is indeed pretty similar to the exploits related to this vulnerability: http://www.securityfocus.com/bid/14088/exploit JF ... View more

The ddts CSCsb29404 has been filled in to take care of this issue. The NSDB is still bundled with IPS MC 2.1 but the links have been changed: Instead of https:// /vms/nsdb/html/expsig_1000.html For some reason, this is now https:// /vms/nsdb/html/nsdb/html/expsig_1000.html Hope this helps, ... View more

I don't know for the other issues but S171 was a particular case. The MC file that was initially posted on cisco.com was corrupted (bad checksum). It has later been replaced by the correct file (MD5 Checksum: 8d8bf893296c246e25666edb57d27e0e) but you have probably downloaded the corrupted file. We are still investigating to figure out how/why this happened. ... View more

The file currently on-line has been fixed. If you wish to double-check, its MD5 checksum should be : 8d8bf893296c246e25666edb57d27e0e ... View more

Upgrading a sensor via VMS is part of our standard testing procedure for a new signature update and it passed the test! Unfortunately, for some reasons, the checksum of the file published on Cisco.com doesn't match the checksum of the file we have tested. My apologies for any inconvenience it could have caused, we are working to have this fixed asap! I'll post again once this has been done. ... View more

You can upload your capture directly on Netpro. When you post an answer, you'll notice the "Add Attachments" link below the Post button. ... View more