At 08:44 AM 11/22/2004, Victor Meghesan wrote:
--- Matthew Watchinski <mwatchinski@sourcefire.com>
wrote:
<snip>
> web-misc.rules:alert tcp $EXTERNAL_NET any ->
> $HTTP_SERVERS $HTTP_PORTS
> (msg:"WEB-MISC weblogic/tomcat .jsp view source
> attempt";
> flow:to_server,established; uricontent:".jsp";
> nocase;
> pcre:!"/^\w+\s+[^\n\s\?]*\.jsp/smi";
> reference:bugtraq,2527;
> classtype:web-application-attack; sid:1054; rev:7;)
>
> Here is how it works.
>
<snip>
Here is what happens:
a) the GET and Referer: lines below match uricontent:
.jsp
b) the other lines match the negated regexp pcre:!...
and nothing in there (the example content I send) is a
%
c)the rule fires up with false positives!
because of a) + b) then c) happens
<snip>
> >Referer: http://xxx.xxx.xxx/l/l.jsp
It would seem to be happening because the PCRE will not match the Referrer:
header like it should. This does however assume that the GET and the
Referrer: are in separate packets from a stream4 perspective. Since there's
a lot of junk inbetween, and stream4's reassembly is pretty limited in
size, this is very possible.
It won't ever match any Referrer: header at all, because the inclusion of a
: breaks the \w+\s+ sequence at the start, and the prce fails to match.
Thus this rule can easily false-fire on a http request with a Referrer:
that's a .jsp.
If uricontent matches Referer: headers, then the PCRE needs to change to
handle that.
Try this prce instead... it should fix the false match.
/^\w+\:?\s+[^\n\s\?]*\.jsp/smi
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
