Skip to main content
Croatlan
Croatlan
New Member
December 11, 2020
Question

Suddenly getting CoDeSys.Scada.Webserver.Stack.Buffer.Overflow warnings

  • December 11, 2020
  • 0 replies
  • 1840 views

This started couple of hours ago. I'm receiving alerts from my firewall that the intrusion prevention has detected CoDeSys.Scada.Webserver.Stack.Buffer.Overflow and it is now detected on 3 computers. Each time it shows that the mtalk.google.com server at source IP of 173.194.219.188 was the cause. Is this a false positive? Here's the sample:

 

Message meets Alert condition The following intrusion was observed: "CoDeSys.Scada.Webserver.Stack.Buffer.Overflow". date=2020-12-11 time=16:11:04 devname=XXXXXXXXX devid=FGXXXXXXXXXXX logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" eventtime=1607724663 severity="high" srcip=173.194.219.188 srccountry="United States" dstip=XXX.XXX.XXX.XXX srcintf="wan1" srcintfrole="wan" dstintf="lan" dstintfrole="lan" sessionid=48218666 action="detected" proto=6 service="P2P" policyid=1 attack="CoDeSys.Scada.Webserver.Stack.Buffer.Overflow" srcport=5228 dstport=52071 hostname="mtalk.google.com" direction="incoming" attackid=30650 profile="default" ref="http://www.fortinet.com/ids/VID30650" incidentserialno=1468462193 msg="SCADA: CoDeSys.Scada.Webserver.Stack.Buffer.Overflow," crscore=30 crlevel="high"

Terms & ConditionsAccessibility statement