Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
The signature 3216 is looking for a pattern ../.. Appending this at the front of an URL causes a crash in IIS 2.0 or prior versions.The signature 3214 is looking for pattern /..\ which allows directory traversal in IIS 1.0.
This signature will not make it in the IDS Signature Update as IDS is not primarily a virus detector.Try the following Custom SignatureCurrent Signature: Engine STRING.TCP SIGID 20000 SigName: myparty virus Parameters 1 - AlarmInterval ...
We have not yet seen false positives on Sig 4601 - CheckPoint Firewall RDP bypass. The signature looks for specific binary pattern on UDP port 259, which is generally not in high use.Do you have a Check Point Firewall installed ?Can you send a log fi...
A temporary workaround if u want to upgrade to S13.Edit the file IMAGE_VERSION in /usr/nr directory and make the version ID there 3.0(3)S12.You will then be able to upgrade the sensor to S13.Rohit
