NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
VPPBEEF
Dec 10, 2015Aspirant
WEB Apache Struts Wildcard Matching OGNL Code
Hi Community!
I'm getting this reports daily (30 more or less), and I've been reading about it, and I don't know what exacatly what can I do to my firewalls to get rid of this messages, or if because of this messages they are working fine. Prosecure UTM10
Any advice?
At time : 2015-12-10 15:12:36
Intrusion Prevention System detected attack : WEB Apache Struts Wildcard Matching OGNL Code Execution -5 (CVE-2013-2134) .
The action is : drop
More information about this attack:
Category : Apache
Protocol : tcp
Client IP : 192.168.1.117 Client Port : 54916
Server IP : 52.70.0.55 Server Port : 80
-------------------------------------------------------------------------------------------------------------------------------
Sometimes in between i get this one as well:
At time : 2015-12-10 14:56:45
Intrusion Prevention System detected attack : WEB URI Handler Buffer Overflow - GET -1 .
The action is : drop
More information about this attack:
Category : Misc
Protocol : tcp
Client IP : 192.168.1.117 Client Port : 54221
Server IP : 205.180.85.169 Server Port : 80
Thanks in advance
Thank you very much and for your team too. You guys are awesome!
6 Replies
- JohnRoNETGEAR Employee Retired
VPPBEEF,
Welcome to the community!
It appears that these are just normal logs detected by the IPS. It looks like it might be coming from phishing sites but I'll have to check on that and get back to you. What is the firmware version that your are running on the UTM10?
Thanks,
- VPPBEEFAspirant
Hi John,
Thanks for your help. The firmware version is the one under: Administration>System Update>Firmware?
If it's that one says:
Firmware reboot:
Active - Version 3.6.2-1
I hope this help... Otherwise let me know. Thanks!
- JohnRoNETGEAR Employee Retired
Hello again VPPBEEF,
It appears that you already have the latest firmware version. I'll try to look up more about the log entries you are getting, though it may look normal to me.
I'll get back to you if I find something related.
Thanks,
Related Content
NETGEAR Academy

Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!