SMTP attacks - block result & stats query

[Dissidente]

Hi.

I've noticed some SMTP blocked attacks since yesterday, more exactly #3461 SMTP Content-Type overflow attempt and #11837 SMTP MS Windows Mail UNC navigation remote command execution, which reading the attack info I can relate to crafted e-mails with specific links to exploit these vulnerabilities.

Now, my good friend, the intrusion prevention module has swiftly blocked these e-mails (which I suspect might be just a few), but I wanted to understand exactly what 'block' means in this context. Will it cut the connection? Will it reply with an error string (ie. 450 - Go F-yourself) I suspect it will cut the connection, hence the repeated knocks while our upstream MTA tries to deliver the enqueue e-mail(s). Can you confirm what is the action?

Also, is there any way to query intrusion prevention logs to collect some stats (like number of events per internal IP, category percentage, destinations, etc)?

Thanks guys

[vihag]

I get a lot of these too. I suspect it blocks the connection so that the sending server tries to send and resend and eventually returns an ndr to the user. I was sort of worried these might be legitimate emails, but I haven't had any complaints so far.

[dmorris]

It just resets the connection.

More likely to be a false positive than a true positive.