Veeam Guest Interaction Proxy creates false IPS Alerts

Hey,

after deploying our new XGS3300 with SFOS v21 we noticed several IPS Alerts which are created from a Veeam Guest Interaction Proxy to the Veeam Backup Server:

Attack : FILE-OTHER Adobe Premier Pro ibfs32.dll dll-load exploit attempt

Attacker: Guest Interaction Proxy

Victim: Backup Server

We created an exception now, but are there any issues known?

Regards

Peter

Edited TAGs
[edited by: Erick Jan at 2:32 AM (GMT -8) on 25 Nov 2024]

Top Replies

Vivek Jagad 17 hours ago +1 suggested

Hi Peter Riederer , Thank you for reaching out to the community, the following IPS signature is FILE-OTHER Adobe Premier Pro ibfs32.dll dll-load exploit attempt, is up to date in the IPS Signature database…

Parents

0 Vivek Jagad 17 hours ago

Hi Peter Riederer ,

Thank you for reaching out to the community, the following IPS signature is FILE-OTHER Adobe Premier Pro ibfs32.dll dll-load exploit attempt, is up to date in the IPS Signature database, you can refer here. CVE-2010- 3150. There are no known issues. Request you to scan the source machine thoroughly with an endpoint.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 Peter Riederer 3 hours ago in reply to Vivek Jagad

Hello Vivek,

on both Servers Sophos Intercept X (MDR Complete) is running and up2date.

Regards

Peter
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Vivek Jagad 1 hour ago in reply to Peter Riederer

did you check the source's traffic for any malicious web traffic ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Vivek Jagad 1 hour ago in reply to Peter Riederer

did you check the source's traffic for any malicious web traffic ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data