The following is a list of IPS / Snort SIDs in the UTM which have been reported to cause false positives and/or application conflicts.
It is up to the reader to determine if their systems are all patched before disabling any rules, especially for common apps like MSIE.
Each SID is linked to a report in these forums:
26616 - JavaScript exploit, undocumented. Numerous false-positive reports - interferes with some web sites and possibly Steam.
2180, 2181, 16281, & 16282 - POLICY Rule, Intended to block BitTorrent (i.e. not a "false positive").Numerous reports.
24397 - POLICY Rule, Intended to block Steam (i.e. not a "false positive").
5693 & 5999 - POLICY Rule, Intended to block Skype (i.e. not a "false positive").
From Frank (below):
Skype -
6001 - This event is generated when network traffic that indicates Skype is being used.
5998 - This event indicates that the Skype is being used on the protected network.
5692, 5693, 5694, - This event is generated when network traffic that indicates Skype is being used. This is a Peer-to-Peer (P2P) application.
15169 - POLICY Rule, Intended to block XBox Live (i.e. not a "false positive").
18681 - POLICY Rule, "PDF with embedded JavaScript" (i.e. not a "false positive"). I set this to Alert instead of Block as it was blocking PDFs generated by Google Drive.
26989 & 26926 - McAfee ZIP file bypass vuln circa 2004; false positives reported with Steam.
19187 - TMG Firewall client (whatever that is) vulnerability. Many reports. This rule currently appears to only Alert, not Block. If you're not using the TMG client, it should be safe to disable.
16482 - MS IE vuln from 2010; reports of blocking misc HTTP traffic.
23115 - MySQL5 password bypass exploit; 1 report of interfering with legitimate MySQL traffic.
2705 - MS GDI JPEG vulns from 2004; Snort.org lists known false positives with http jpeg traffic.
23350 - unknown vuln; 1 report of Amazon AWS interference.
26989 - A/V Zip Bypass; 1 report of ISO download interference.
24103 - C&C Malware Post - this blocks images in these forums (reported by myself). Should be safe to disable as this flags symptoms of infections (C&C) rather than blocking the infection vector
13318 - MS WMP vuln from 2007; reported false positives with Tivo and other traffic.
10115 - MS GDI WMF vuln from 2006; I've seen what I believe are false positives, will try to confirm.
17363 - OSX DMG vuln from 2007; I've seen what I believe are false positives, will try to confirm.
20445 - PDF Foxit Reader title overflow attempt; I've seen this triggered by a PDF from a local college, but I can't promise it was not infected. I've set to alert instead of drop as I don't use Foxit Reader.
12632 - Win2k & XP - XP SP2 JPEG vuln; I've seen it triggered by mp3 podcast downloads.
21112 - RealPlayer mpeg flaw - triggers on HTML5 videos on Youtube.com aka googlevideo.com
49759, 29465, & 29466 - "Corel PDF" vuln; false positives on Android devices (see post below dated 2014-02-19); disable unless using unpatched Corel apps.
Dropbox (policy, from Frank below):
18608 - This event is generated when network traffic that indicates Dropbox Desktop Software in use is being used.
18609 - This event is generated when network traffic that indicates Dropbox Desktop Software in use is being used.
21513 - HOIC DOS alert; reported (below, 2014-07-16) false positives with Nokia proxy cluster.
IMHO, the Policy Rules should be exposed in App Control, not buried in the IPS rulesets.
Feature Request: Expose "Corporate Policy Violation" IPS rules via the Attack Pattern groups
Also please see my Feature Request for finer ruleset selection:
Increase Attack Patterns selections in IPS settings
If you have a NEW report, please post another thread about it, and post a link to the thread here.
If I missed something already reported in 8.x or 9.x, or any other related feature requests, please link to it below.
Barry
This thread was automatically locked due to age.
