Signature Detail
Short Name |
SMTP:OVERFLOW:REPLY-LINE |
|---|---|
Severity |
High |
Recommended |
No |
Category |
SMTP |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
SMTP: Reply Line
This protocol anomaly triggers when it detects a server reply line in an SMTP connection that is too long. This can indicate a buffer overflow attempt by a compromised or malicious SMTP server.
Extended Description
Any SMTP server-to-client traffic detected on TCP port 25 that exceeds 512 bytes constitutes a protocol anomaly. This condition could indicate a network configuration error or that an attacker is injecting malformed packets into the network to cause a buffer overflow.
References