S492 : Bad Custom Signature ID ... [5577]

netsec · ‎05-31-2010

Hi,

I've implemented signature update S492, but apparently there is a problem with the new signature 5577.1 : SMB Secure NULL Login Attempt . During the upgrade process run from our CSM V3.3.1, the deployment manager returns an error :

instance=sig0:unspecifiedError:Bad Custom Signature ID ... [5577]. Can not create a custom signature with sig-id < 60000

When I verifie on the sensors themselves, this new signature is nowhere to be found.

Best regards.

Jennifer Halim · ‎05-31-2010

Signature# 5577 is a new signature from s492 signature update:

http://www.cisco.com/web/software/282549755/34252/IPS-sig-S492.readme.txt

Do you happen to have a custom signature with sig# 5577 by any chance?

If you don't, then you might want to open a TAC case as it might be a new bug.

netsec · ‎05-31-2010

No, we don't have such custom signature. Moreover I think custom signatures start from 60000 ; so I suppose there should be something wrong with this new subsig. I'll open up then as you advise a support call.

Jennifer Halim · ‎05-31-2010

Yes, please go ahead and open a TAC case. Thanks.