[Snort-sigs] SID 8440: IMAP SSLv2 openssl get shared ciphers overflow attempt

I'm getting a boatload of alerts from one host for this SID.  The rule 
looks for [01 03] (SOH followed by ETX) at a depth of 2 bytes.  Every 
single packet that triggers this alert begins with this sequence: 17 03 01 
03 80

ETB ETX SOH ETX followed by a high ascii character.  So, End of 
Transmission Block, End of Text, Start of Heading, End of Text, high ascii.

Any of you uber-geeks want to translate what this host is doing?  Or 
attempting to do?  (BTW, I suspect this is "benign" activity.  The source 
host is on a local ISP's network, and the dest host is our imap server. 
The alerts are triggered every two minutes, give or take a hundredth of a 
second, so it looks like aggressive mail checking.)

Is this a broken client?  Eeeevvviiilll?

Paul Schmehl (pauls@utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

p7sNG5VeBGhqm.p7s
Description: S/MIME cryptographic signature

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs