# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others. References in the rules themselves
# should be used for linking to other's work.
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
#
# $Id$
#
#
Rule: MS-SQL/SMB raiseerror possible buffer overflow
--
Sid: 1386
--
Summary:
--
Impact:
--
Detailed Information:
--
Affected Systems:
--
Attack Scenarios:
--
Ease of Attack:
--
False Positives: This error will occur during normal transations if
"The version of the MSX is not recent enough to support this TSX."
(Or I am crazy, and this is an unknown (to me) exploit!)
--
False Negatives:
--
Corrective Action:
--
Contributors:
--
Additional References:
00 00 06 3F FF 53 4D 42 2F 00 00 00 00 18 03 80 ...?.SMB/.......
00 00 00 00 00 00 00 00 00 00 00 00 04 10 FE CA ...............J
00 38 00 18 0C FF 00 00 00 00 80 00 00 00 00 FF .8..............
FF FF FF 08 00 04 06 00 10 04 06 3B 00 04 06 01 ..........;....
01 06 04 00 00 01 00 49 00 46 00 20 00 28 00 45 .......I.F. .(.E
00 58 00 49 00 53 00 54 00 53 00 20 00 28 00 53 .X.I.S.T.S. .(.S
00 45 00 4C 00 45 00 43 00 54 00 20 00 2A 00 20 .E.L.E.C.T. .*.
00 46 00 52 00 4F 00 4D 00 20 00 6D 00 73 00 64 .F.R.O.M. .m.s.d
00 62 00 2E 00 64 00 62 00 6F 00 2E 00 73 00 79 .b...d.b.o...s.y
00 73 00 6F 00 62 00 6A 00 65 00 63 00 74 00 73 .s.o.b.j.e.c.t.s
00 20 00 57 00 48 00 45 00 52 00 45 00 20 00 28 . .W.H.E.R.E. .(
00 6E 00 61 00 6D 00 65 00 20 00 3D 00 20 00 4E .n.a.m.e. .=. .N
00 27 00 73 00 70 00 5F 00 73 00 71 00 6C 00 61 .'.s.p._.s.q.l.a
00 67 00 65 00 6E 00 74 00 5F 00 63 00 68 00 65 .g.e.n.t._.c.h.e
00 63 00 6B 00 5F 00 6D 00 73 00 78 00 5F 00 76 .c.k._.m.s.x._.v
00 65 00 72 00 73 00 69 00 6F 00 6E 00 27 00 29 .e.r.s.i.o.n.'.)
00 20 00 41 00 4E 00 44 00 20 00 28 00 74 00 79 . .A.N.D. .(.t.y
00 70 00 65 00 20 00 3D 00 20 00 27 00 50 00 27 .p.e. .=. .'.P.'
00 29 00 29 00 29 00 20 00 45 00 58 00 45 00 43 .).).). .E.X.E.C
00 55 00 54 00 45 00 20 00 6D 00 73 00 64 00 62 .U.T.E. .m.s.d.b
00 2E 00 64 00 62 00 6F 00 2E 00 73 00 70 00 5F ...d.b.o...s.p._
00 73 00 71 00 6C 00 61 00 67 00 65 00 6E 00 74 .s.q.l.a.g.e.n.t
00 5F 00 63 00 68 00 65 00 63 00 6B 00 5F 00 6D ._.c.h.e.c.k._.m
00 73 00 78 00 5F 00 76 00 65 00 72 00 73 00 69 .s.x._.v.e.r.s.i
00 6F 00 6E 00 20 00 40 00 72 00 65 00 71 00 75 .o.n. .@.r.e.q.u
00 69 00 72 00 65 00 64 00 5F 00 6D 00 69 00 63 .i.r.e.d._.m.i.c
00 72 00 6F 00 73 00 6F 00 66 00 74 00 5F 00 76 .r.o.s.o.f.t._.v
00 65 00 72 00 73 00 69 00 6F 00 6E 00 20 00 3D .e.r.s.i.o.n. .=
00 20 00 30 00 78 00 30 00 37 00 30 00 30 00 30 . .0.x.0.7.0.0.0
00 32 00 35 00 32 00 20 00 45 00 4C 00 53 00 45 .2.5.2. .E.L.S.E
00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 . . . . . . . .
00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 . . . . . . . .
00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 . . . . . . . .
00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 . . . . . . . .
00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 . . . . . . . .
00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 . . . . . . . .
00 20 00 42 00 45 00 47 00 49 00 4E 00 20 00 44 . .B.E.G.I.N. .D
00 45 00 43 00 4C 00 41 00 52 00 45 00 20 00 40 .E.C.L.A.R.E. .@
00 6D 00 73 00 78 00 5F 00 76 00 65 00 72 00 73 .m.s.x._.v.e.r.s
00 69 00 6F 00 6E 00 20 00 4E 00 56 00 41 00 52 .i.o.n. .N.V.A.R
00 43 00 48 00 41 00 52 00 28 00 31 00 36 00 29 .C.H.A.R.(.1.6.)
00 20 00 53 00 45 00 4C 00 45 00 43 00 54 00 20 . .S.E.L.E.C.T.
00 40 00 6D 00 73 00 78 00 5F 00 76 00 65 00 72 .@.m.s.x._.v.e.r
00 73 00 69 00 6F 00 6E 00 20 00 3D 00 20 00 43 .s.i.o.n. .=. .C
00 4F 00 4E 00 56 00 45 00 52 00 54 00 28 00 4E .O.N.V.E.R.T.(.N
00 56 00 41 00 52 00 43 00 48 00 41 00 52 00 28 .V.A.R.C.H.A.R.(
00 32 00 29 00 2C 00 20 00 43 00 4F 00 4E 00 56 .2.).,. .C.O.N.V
00 45 00 52 00 54 00 28 00 49 00 4E 00 54 00 2C .E.R.T.(.I.N.T.,
00 20 00 43 00 4F 00 4E 00 56 00 45 00 52 00 54 . .C.O.N.V.E.R.T
00 28 00 42 00 49 00 4E 00 41 00 52 00 59 00 28 .(.B.I.N.A.R.Y.(
00 31 00 29 00 2C 00 20 00 28 00 43 00 4F 00 4E .1.).,. .(.C.O.N
00 56 00 45 00 52 00 54 00 28 00 42 00 49 00 4E .V.E.R.T.(.B.I.N
00 41 00 52 00 59 00 28 00 32 00 29 00 2C 00 20 .A.R.Y.(.2.).,.
00 40 00 40 00 6D 00 69 00 63 00 72 00 6F 00 73 .@.@.m.i.c.r.o.s
00 6F 00 66 00 74 00 76 00 65 00 72 00 73 00 69 .o.f.t.v.e.r.s.i
00 6F 00 6E 00 20 00 2F 00 20 00 30 00 78 00 66 .o.n. ./. .0.x.f
00 66 00 66 00 66 00 29 00 20 00 2F 00 20 00 32 .f.f.f.). ./. .2
00 35 00 36 00 29 00 29 00 29 00 29 00 20 00 2B .5.6.).).).). .+
00 20 00 4E 00 27 00 2E 00 27 00 20 00 2B 00 20 . .N.'...'. .+.
00 43 00 4F 00 4E 00 56 00 45 00 52 00 54 00 28 .C.O.N.V.E.R.T.(
00 4E 00 56 00 41 00 52 00 43 00 48 00 41 00 52 .N.V.A.R.C.H.A.R
00 28 00 32 00 29 00 2C 00 20 00 43 00 4F 00 4E .(.2.).,. .C.O.N
00 56 00 45 00 52 00 54 00 28 00 49 00 4E 00 54 .V.E.R.T.(.I.N.T
00 2C 00 20 00 43 00 4F 00 4E 00 56 00 45 00 52 .,. .C.O.N.V.E.R
00 54 00 28 00 42 00 49 00 4E 00 41 00 52 00 59 .T.(.B.I.N.A.R.Y
00 28 00 31 00 29 00 2C 00 20 00 28 00 43 00 4F .(.1.).,. .(.C.O
00 4E 00 56 00 45 00 52 00 54 00 28 00 42 00 49 .N.V.E.R.T.(.B.I
00 4E 00 41 00 52 00 59 00 28 00 32 00 29 00 2C .N.A.R.Y.(.2.).,
00 20 00 40 00 40 00 6D 00 69 00 63 00 72 00 6F . .@.@.m.i.c.r.o
00 73 00 6F 00 66 00 74 00 76 00 65 00 72 00 73 .s.o.f.t.v.e.r.s
00 69 00 6F 00 6E 00 20 00 2F 00 20 00 30 00 78 .i.o.n. ./. .0.x
00 66 00 66 00 66 00 66 00 29 00 20 00 25 00 20 .f.f.f.f.). .%.
00 32 00 35 00 36 00 29 00 29 00 29 00 29 00 20 .2.5.6.).).).).
00 2B 00 20 00 4E 00 27 00 2E 00 27 00 20 00 2B .+. .N.'...'. .+
00 20 00 43 00 4F 00 4E 00 56 00 45 00 52 00 54 . .C.O.N.V.E.R.T
00 28 00 4E 00 56 00 41 00 52 00 43 00 48 00 41 .(.N.V.A.R.C.H.A
00 52 00 28 00 34 00 29 00 2C 00 20 00 40 00 40 .R.(.4.).,. .@.@
00 6D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 .m.i.c.r.o.s.o.f
00 74 00 76 00 65 00 72 00 73 00 69 00 6F 00 6E .t.v.e.r.s.i.o.n
00 20 00 26 00 20 00 30 00 78 00 66 00 66 00 66 . .&. .0.x.f.f.f
00 66 00 29 00 20 00 52 00 41 00 49 00 53 00 45 .f.). .R.A.I.S.E
00 52 00 52 00 4F 00 52 00 28 00 4E 00 27 00 54 .R.R.O.R.(.N.'.T
00 68 00 65 00 20 00 76 00 65 00 72 00 73 00 69 .h.e. .v.e.r.s.i
00 6F 00 6E 00 20 00 6F 00 66 00 20 00 74 00 68 .o.n. .o.f. .t.h
00 65 00 20 00 4D 00 53 00 58 00 20 00 28 00 25 .e. .M.S.X. .(.%
00 73 00 29 00 20 00 69 00 73 00 20 00 6E 00 6F .s.). .i.s. .n.o
00 74 00 20 00 72 00 65 00 63 00 65 00 6E 00 74 .t. .r.e.c.e.n.t
00 20 00 65 00 6E 00 6F 00 75 00 67 00 68 00 20 . .e.n.o.u.g.h.
00 74 00 6F 00 20 00 73 00 75 00 70 00 70 00 6F .t.o. .s.u.p.p.o
00 72 00 74 00 20 00 74 00 68 00 69 00 73 00 20 .r.t. .t.h.i.s.
00 54 00 53 00 58 00 2E 00 20 00 20 00 56 00 65 .T.S.X... . .V.e
-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
