May be somebody know how to completely disable BO protection?
I'd faced with very big problem with BOEP in Proventia Desktop (so, now
I don't use BOEP on Desktops), and I don't want to repeat the same on my
servers!
Thanks.
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 095 745 89 50
tel +7 095 777 77 07 (1613)
-----Original Message-----
From: issforum-bounces@iss.net
[mailto:issforum-bounces@iss.net] On Behalf Of Andrew Plato
Sent: Friday, October 07, 2005 7:20 PM
To: Cunningham, Chris, R.
Cc: issforum@iss.net
Subject: Re: [ISSForum] Server Sensors that just die
Yeah, the BO stuff is awfully quirky. I have come to the
conclusion that NOBODY makes a decent BO protection. Cisco's
security agent also has problems. McAfee/Entercept will slow
a machine down to a crawl, and it generates false positives like mad.
-----------------------------------------------
Andrew Plato, CISSP
President/Principal Consultant
Anitian Enterprise Security
-----------------------------------------------
-----Original Message-----
From: Cunningham, Chris, R. [mailto:CCunningham@WilmingtonTrust.com]
Sent: Friday, October 07, 2005 6:57 AM
To: Andrew Plato
Subject: RE: [ISSForum] Server Sensors that just die
Andrew,
I'm not sure if this is your issue, but I would definitely
disable the Buffer Overflow protection on server sensors, we
have had nothing but trouble on Proventia Desktop with this.
Also, there is a new build out there with SP 4.3, but I don't
remember where it is on the site. It also has a lot of
advanced parameters already included that we have previously
had to insert into every new install.
Hope this helps,
Chris R. Cunningham, CISSP | Wilmington Trust Information Protection |
302.636.6225 | Security Hotline 302.636.6222
-----Original Message-----
From: issforum-bounces@iss.net
[mailto:issforum-bounces@iss.net] On Behalf Of Andrew Plato
Sent: Thursday, October 06, 2005 3:10 PM
To: issforum@iss.net
Subject: [ISSForum] Server Sensors that just die
This is a daunting little problem I have had lately. Server
sensors that just croak. They stop working. When you try to
restart them, you get an error that the OS cannot find the
file specified. Nothing will restart them - rebooting,
nothing. The issdeamon is running. Just not the Buffer
Overflow / IPS engine.
The only fix I have been able to discover is to reinstall SS
and start over.
Anybody have any info on this? I checked the Knowledge Base
on this, but nothing.
Also, when is ISS going to put out a new Server Sensor build.
I am tired of installing it and then having to go through the
whole service pack update. Can't we get a repackage?
Oh, and while I am complaining - where the heck is "Proventia
Server??!?!?"
_____________________________________
Andrew Plato, CISSP
President / Principal Consultant
ANITIAN ENTERPRISE SECURITY
Your Expert Partner for Security & Networking
3800 SW Cedar Hills Blvd, Suite 280
Beaverton, OR 97005
503-644-5656 Office
503-214-8069 Fax
503-201-0821 Mobile
www.anitian.com
_____________________________________
PGP/GPG public key available at: http://www.anitian.com/corp/keys.htm
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet
Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
Investment products are not insured by the FDIC or any other
governmental agency, are not deposits of or other obligations
of or guaranteed by Wilmington Trust or any other bank or
entity, and are subject to risks, including a possible loss
of the principal amount invested. This e-mail and any files
transmitted with it may contain confidential and/or
proprietary information. It is intended solely for the use
of the individual or entity who is the intended recipient.
Unauthorized use of this information is prohibited. If you
have received this in error, please contact the sender by
replying to this message and delete this material from any
system it may be on.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet
Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
