May be somebody know how to completely disable BO protection? I'd faced with very big problem with BOEP in Proventia Desktop (so, now I don't use BOEP on Desktops), and I don't want to repeat the same on my servers!
Thanks. --- Best regards, Sergey V. Soldatov. Information security department. tel/fax +7 095 745 89 50 tel +7 095 777 77 07 (1613) > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Andrew Plato > Sent: Friday, October 07, 2005 7:20 PM > To: Cunningham, Chris, R. > Cc: [email protected] > Subject: Re: [ISSForum] Server Sensors that just die > > > Yeah, the BO stuff is awfully quirky. I have come to the > conclusion that NOBODY makes a decent BO protection. Cisco's > security agent also has problems. McAfee/Entercept will slow > a machine down to a crawl, and it generates false positives like mad. > > ----------------------------------------------- > Andrew Plato, CISSP > President/Principal Consultant > Anitian Enterprise Security > > ----------------------------------------------- > > > > > -----Original Message----- > From: Cunningham, Chris, R. [mailto:[EMAIL PROTECTED] > Sent: Friday, October 07, 2005 6:57 AM > To: Andrew Plato > Subject: RE: [ISSForum] Server Sensors that just die > > Andrew, > > I'm not sure if this is your issue, but I would definitely > disable the Buffer Overflow protection on server sensors, we > have had nothing but trouble on Proventia Desktop with this. > Also, there is a new build out there with SP 4.3, but I don't > remember where it is on the site. It also has a lot of > advanced parameters already included that we have previously > had to insert into every new install. > > Hope this helps, > > Chris R. Cunningham, CISSP | Wilmington Trust Information Protection | > 302.636.6225 | Security Hotline 302.636.6222 > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Andrew Plato > Sent: Thursday, October 06, 2005 3:10 PM > To: [email protected] > Subject: [ISSForum] Server Sensors that just die > > > This is a daunting little problem I have had lately. Server > sensors that just croak. They stop working. When you try to > restart them, you get an error that the OS cannot find the > file specified. Nothing will restart them - rebooting, > nothing. The issdeamon is running. Just not the Buffer > Overflow / IPS engine. > > The only fix I have been able to discover is to reinstall SS > and start over. > > Anybody have any info on this? I checked the Knowledge Base > on this, but nothing. > > Also, when is ISS going to put out a new Server Sensor build. > I am tired of installing it and then having to go through the > whole service pack update. Can't we get a repackage? > > Oh, and while I am complaining - where the heck is "Proventia > Server??!?!?" > > > > _____________________________________ > Andrew Plato, CISSP > President / Principal Consultant > ANITIAN ENTERPRISE SECURITY > > Your Expert Partner for Security & Networking > > 3800 SW Cedar Hills Blvd, Suite 280 > Beaverton, OR 97005 > 503-644-5656 Office > 503-214-8069 Fax > 503-201-0821 Mobile > www.anitian.com > _____________________________________ > > PGP/GPG public key available at: http://www.anitian.com/corp/keys.htm > > > _______________________________________________ > ISSForum mailing list > [email protected] > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to > https://atla-mm1.iss.net/mailman/listinfo/issforum > > To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] > > The ISSForum mailing list is hosted and managed by Internet > Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. > > > Investment products are not insured by the FDIC or any other > governmental agency, are not deposits of or other obligations > of or guaranteed by Wilmington Trust or any other bank or > entity, and are subject to risks, including a possible loss > of the principal amount invested. This e-mail and any files > transmitted with it may contain confidential and/or > proprietary information. It is intended solely for the use > of the individual or entity who is the intended recipient. > Unauthorized use of this information is prohibited. If you > have received this in error, please contact the sender by > replying to this message and delete this material from any > system it may be on. > > > > > _______________________________________________ > ISSForum mailing list > [email protected] > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to > https://atla-mm1.iss.net/mailman/listinfo/issforum > > To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] > > The ISSForum mailing list is hosted and managed by Internet > Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. > _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
