[Snort-sigs] False Positive on SMTP HELO Overflow

From: Ron Shuck <rshuck(at)Buchanan.com>
Date: Mon Apr 28 2003 - 16:10:04 EDT

Hi All,

I have been getting a lot of false positives on this SID if the connect terminates. What would be bad about adding a dsize value? Can't be an overflow if the payload isn't a least 500. I have added a "dsize: >499;" to my rule.

Any thoughts?

alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP HELO overflow attempt"; flow:to_server,established; content:"HELO "; dsize: >499; offset:0; depth:5; content:!"|0a|"; within:500; reference:cve,CVE-2000-0042; reference:nessus,10324; classtype:attempted-admin; sid:1549; rev:9;)

Thanks,

Ron Shuck, CISSP, GCIA - Managing Consultant Buchanan Associates - A Technology Company in the People Business

http://www.buchanan.com 
http://www.isc2.orghttp://www.giac.org


-------------------------------------------------------

This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven.
http://thinkgeek.com/sf

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Mon Apr 28 16:50:48 2003