Enhanced Metafile Buffer Overflow, 5694

[darin.marais]

Clients connecting to yahoo mail at 217.12.10.252 via an http proxy server are triggering hundreds of events for Enhanced Metafile Buffer Overflow, id = 5694. Sig Version: S201

Are others seeing the same?

Is this false positive?

[jlimbo]

Hi Darin,

We would like to look into this further, can you please provide a traffic sample or at least an output of produce verbose alert.

Thanks,

Jonathan

[darin.marais]

i dont have one right now. i will try to collect one for you.