Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Signatures
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Snort-sigs] False Positive

from [nnposter] Network Security [Permanent Link]
Subject: Re: [Snort-sigs] False Positive
Date: Fri, 15 Oct 2004 14:42:07 -0600 
Mark Buchanan wrote:

Ok, I took a look at the packet and this is what I found.  First,
while the offset is 5 and that is where Snort started looking, the
depth to look was 15.  The |04 00| sequence was found at 5 (offset) +
13/14.  The |04 00| combination was actually found in the Request ID
field of the packet as apposed to the Community string.

With that said and after reading a little of the snmp_api.h code from
ucd-snmp, I wonder if you could do set this sig to a depth of 2.


This would be vulnerable to a false negative. Any larger ASN.1 sequence
will cause byte at offset 1 to change into a series of bytes, which
shifts the rest of the payload rightward.


It appears that the 5 + 2 byte is the length of the community string,
allowing for a community string of 0 - 255 characters.  The first
digit (5 + 1), I didn't find a reference to.


0x04 = OCTET STRING

Cheers,
nnposter


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: [Snort-sigs] False Positive, Matt Kettler
Next by Date:  [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office., Colin . Slevin
Previous by Thread:  Re: [Snort-sigs] False Positive, Mark Buchanan
Next by Thread:  Re: [Snort-sigs] False Positive, Matt Kettler
Indexes:  [Date] [Thread] [Top] [All Lists]