Please check your $HOME_NET, $HTTP_SERVERS and $EXTERNAL_NET variables in
your snort.conf. This rule should not generate an event on this data with
those variables correctly set.
On 0, Stu Gott <mn3m05yn3@comcast.net> allegedly wrote:
Snort team,
When a debian user is updating zsh via the aptitude package manager, a
false positive will be generated on rule:
Gen:SID 1:1309
Message WEB-CGI zsh access
The reason is that the string '/zsh' naturally occurs in the request. a
typical payload of this particular false positive is:
length = 143
000 : 47 45 54 20 2F 64 65 62 69 61 6E 2F 70 6F 6F 6C GET /debian/pool
010 : 2F 6D 61 69 6E 2F 7A 2F 7A 73 68 2F 7A 73 68 5F /main/z/zsh/zsh_
020 : 34 2E 32 2E 31 2D 35 5F 69 33 38 36 2E 64 65 62 4.2.1-5_i386.deb
030 : 20 48 54 54 50 2F 31 2E 31 0D 0A 48 6F 73 74 3A HTTP/1.1..Host:
040 : 20 66 74 70 2E 75 73 2E 64 65 62 69 61 6E 2E 6F ftp.us.debian.o
050 : 72 67 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 rg..Connection:
060 : 6B 65 65 70 2D 61 6C 69 76 65 0D 0A 55 73 65 72 keep-alive..User
070 : 2D 41 67 65 6E 74 3A 20 44 65 62 69 61 6E 20 41 -Agent: Debian A
080 : 50 54 2D 48 54 54 50 2F 31 2E 33 0D 0A 0D 0A PT-HTTP/1.3....
I'm afraid I'm not familiar enough with snort nor a zsh exploit to submit
a fixed rule myself... since the rule simply looks for the string '/zsh'
I'm not quite sure what the best way to prevent that is...
Cheers!
Stu
+-----------------------------------------------------------------+
Nigel Houghton Research Engineer Sourcefire Inc.
Vulnerability Research Team
Cat: "Forget red - let's go all the way up to brown alert!"
Kryten: "There's no such thing as a brown alert sir."
Cat: "You won't be saying that in a minute!"
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
