This is a known problem with ISS. We have had a ticket open since October.
They have been extremely lax in addressing it. I'm surprised more have not
said something about it. The same situation exists in
Content_Compound_File_Bad_Extension, HTTP_FileTypeURL, and likely others.
There is no date estimate for a fix.
Regards,
Kevin
614-224-8204
-----Original Message-----
From: issforum-bounces@iss.net [mailto:issforum-bounces@iss.net] On Behalf
Of Soldatov, Sergey V.
Sent: Friday, January 13, 2006 7:29 AM
To: issforum@iss.net
Subject: [ISSForum] TCP_Port_Scan
Hi list!
In my SP console I see a lot of TCP_Port_Scan events for Internet IPs to
my local IPs. I suppose that this are false positives because of HTTP
replies from visited Web-sites, but unfortunately I can't figure out if
it's so, because SP (and it's strange) does not show attacker's source
port in event details... Does anybody can recommend something to help me
investigate these TCP_Port_Scan events.
May be someone have experience in tuning TCP_Port_Scan event?
Any feedback will be welcome.
Thanks!
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 495 745 89 50
tel +7 495 777 77 07 (1613)
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
CONFIDENTIALITY NOTICE: The Ohio Public Employees Retirement System intends
this e-mail message, and any attachments, to be used only by the person(s) or
entity to which it is addressed. This message may contain confidential and/or
legally privileged information. If the reader is not the intended recipient of
this message or an employee or agent responsible for delivering the message to
the intended recipient, you are hereby notified that you are prohibited from
printing, copying, storing, disseminating or distributing this communication.
If you received this communication in error, please delete it from your
computer and notify the sender by reply e-mail.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
