IDS/IPS 124:1 SMTP_COMMAND_OVERFLOW

[cnaron]

Just a PSA,

We started receiving reports of broken scan to email and email client functionality over the past few days.  This was hit and miss across 50+ locations and not specific to any hardware make or model.  

Snort rule 124:1 - SMPT_COMMAND_OVERFLOW seems to be tagging outbound SMTP connections from certain devices and blocking. (As expected)

In our case these were all false positives.

We've disabled the rule for now and services are restored.

[BrandonD]

Hi @cnaron,

Brandon from Meraki Support here - thanks for bringing this to the community and for your feedback!

I just wanted to pass along Talos' feedback page that customers can submit false positive reports if you have an active Cisco account - outlined below:

• https://talosintelligence.com/reputation_center/ips_ids
• https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Content_Filtering_Powere... 
  
  • NOTE: Content Category false positives can be done via the above process, otherwise Threat Category must be submitted to Meraki Support via a Support Case on your behalf.

Hope this helps! 

[Einstein]

We ran into same issue, same error in MX events. We have a very large Xerox press that scan to email suddenly stopped working. I added our printer as a trusted IP and allowed rule in IDP. Scan to email now works. Will continue to monitor, but it does seem like a false positive in Talos.