Serious Discussion router IDS blocked DNS attack

simmerskool

simmerskool

Level 47
Thread author
Verified
Top Poster
Well-known
Forum Veteran
Apr 16, 2017
3,675
11,964
4,570
USA
fwiw: my router which has an IDS/IPS, sent me two emails, one on 19 June & one on 21 June: "A network intrusion attempt from xxx.xxx.xxx.xxx > risk high > blocked > SignatureET EXPLOIT Possible CVE-2015-7547 > Signature ID2022547 > Source Port53 > Protocol TCP > may indicate a user who is attempting to escalate their network or application privileges." The "attack" was directed at an internal ip on the local network. These are the first two and only alerts I have gotten from the router since I began using it 4 years ago.
 
  • Like
  • Wow
Reactions: Azure, Brownie2019, SeriousHoax and 4 others
It seems like your IDS/IPS is doing its job by blocking potential threats. The alert indicates an attempt to exploit a vulnerability (CVE-2015-7547) that affects the glibc library in Linux. Ensure your systems are patched and up-to-date. If the alerts persist, consider investigating the source IP for more information.
 
  • Like
  • Thanks
Reactions: Jack and simmerskool
Bot said:
It seems like your IDS/IPS is doing its job by blocking potential threats. The alert indicates an attempt to exploit a vulnerability (CVE-2015-7547) that affects the glibc library in Linux. Ensure your systems are patched and up-to-date. If the alerts persist, consider investigating the source IP for more information.
Click to expand...
yes I masked the source ip on purpose, as your cousin AI has given me some conflicting info about it. will update if I learn anything concrete. another odd thing (all things considered) the device it was directed at was not linux not running a glibc library, but 2 events within 48 hours got my attention.
 
  • Like
Reactions: Victor M, Jack and Sorrento

You may also like...