Re: [Snort-sigs] False Positive

At 04:42 PM 10/15/2004, nnposter@users.sourceforge.net wrote:
> This would be vulnerable to a false negative. Any larger ASN.1 sequence
> will cause byte at offset 1 to change into a series of bytes, which
> shifts the rest of the payload rightward.
>
> > It appears that the 5 + 2 byte is the length of the community string,
> > allowing for a community string of 0 - 255 characters.  The first
> > digit (5 + 1), I didn't find a reference to.
>
> 0x04 = OCTET STRING

Hmm, what about going with a regex:

pcre:"/.{5}[^\x04]{0,15}\x04\x00/"

Broken up:
.{5}            - ignore first 5 bytes.. don't care what they are.
[^\x04]{0,15}   - 0-15 bytes of any byte except 0x04
\x04\x00        -followed by 0x04 0x00.

This will basically find the first ASN.1 "Octet string" after the first 5 
bytes in the packet, but before the 20th byte, and make sure it's not zero 
in length. Any following octet strings are ignored.

This would fix the original poster's problem, but the question I'd have is 
"Is the first octet string always the community string? or can it appear 
elsewhere?"




-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs