This is a known problem with ISS. We have had a ticket open since October. They have been extremely lax in addressing it. I'm surprised more have not said something about it. The same situation exists in Content_Compound_File_Bad_Extension, HTTP_FileTypeURL, and likely others. There is no date estimate for a fix.
Regards, Kevin 614-224-8204 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Soldatov, Sergey V. Sent: Friday, January 13, 2006 7:29 AM To: [email protected] Subject: [ISSForum] TCP_Port_Scan Hi list! In my SP console I see a lot of TCP_Port_Scan events for Internet IPs to my local IPs. I suppose that this are false positives because of HTTP replies from visited Web-sites, but unfortunately I can't figure out if it's so, because SP (and it's strange) does not show attacker's source port in event details... Does anybody can recommend something to help me investigate these TCP_Port_Scan events. May be someone have experience in tuning TCP_Port_Scan event? Any feedback will be welcome. Thanks! --- Best regards, Sergey V. Soldatov. Information security department. tel/fax +7 495 745 89 50 tel +7 495 777 77 07 (1613) _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. CONFIDENTIALITY NOTICE: The Ohio Public Employees Retirement System intends this e-mail message, and any attachments, to be used only by the person(s) or entity to which it is addressed. This message may contain confidential and/or legally privileged information. If the reader is not the intended recipient of this message or an employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that you are prohibited from printing, copying, storing, disseminating or distributing this communication. If you received this communication in error, please delete it from your computer and notify the sender by reply e-mail. _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
