S492 : Bad Custom Signature ID ... [5577]

[netsec]

Hi,

I've implemented signature update S492, but apparently there is a problem with the new signature 5577.1 : SMB Secure NULL Login Attempt . During the upgrade process run from our CSM V3.3.1, the deployment manager returns an error :

instance=sig0:unspecifiedError:Bad Custom Signature ID ... [5577].  Can not create a custom signature with sig-id < 60000

When I verifie on the sensors themselves, this new signature is nowhere to be found.

Best regards.

[Jennifer Halim]

Signature# 5577 is a new signature from s492 signature update:

http://www.cisco.com/web/software/282549755/34252/IPS-sig-S492.readme.txt

Do you happen to have a custom signature with sig# 5577 by any chance?

If you don't, then you might want to open a TAC case as it might be a new bug.

[netsec]

No, we don't have such custom signature. Moreover I think custom signatures start from 60000 ; so I suppose there should be something wrong with this new subsig. I'll open up then as you advise a support call.

[Jennifer Halim]

Yes, please go ahead and open a TAC case. Thanks.