This morning, I started getting a bunch of email alerts from the UTM, telling me it was dropping packets due to snort rules 29465 and 29466 - "FILE-OTHER Corel PDF fusion XPS stack buffer overflow attempt"
The source IP's belong to Google (both ipV4 and IPv6) and the traffic was destined for my iPhone and my wife's Android phone.
Snort themselves have no documentation for these rules, but I did find them mentioned in their changelog where they have changed to be Disabled by default.
That changelog entry was dated almost two weeks ago, which begs the question of how long is the lead time for this sort of change to get included in a Sophos pattern update?
Meanwhile, I'm off to disable those rules manually.
This thread was automatically locked due to age.
