This is being reviewed for inclusion in the Community rules, and will be
released as soon as it can be cofirmed as valid.
Alex Kirk
Community Rules Maintainer
Sourcefire, Inc.
Hi,
Please check and add this rule :
icmp.rules:alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP
linux DoS sctp exploit"; icode:2; itype:3; content:"|28 00 00 50 00 00
00 00 F9 57 1F 30 00 00 00 00 00 00 00 00 00 00 00 00|";
reference:nessus,19777;)
look this packet with tcpdump393 :
12:26:57.540160 IP (tos 0xc0, ttl 64, id 62246, offset 0, flags
[none], proto: ICMP (1), length: 72) 127.0.0.1 > 127.0.0.1: ICMP
127.0.0.1 protocol 132 unreachable, length 52
IP (tos 0x0, ttl 64, id 62247, offset 0, flags [none], proto:
SCTP (132), length: 44) 127.0.0.1.10240 > 127.0.0.1.80: sctp
1) [Bad chunk length 0]
0x0000: 45c0 0048 f326 0000 4001 88cc 7f00 0001
E..H.&..@.......
0x0010: 7f00 0001 0302 bc25 0000 0000 4500 002c
.......%....E..,
0x0020: f327 0000 4084 8924 7f00 0001 7f00 0001
.'..@..$........
0x0030: 2800 0050 0000 0000 f957 1f30 0000 0000
(..P.....W.0....
0x0040: 0000 0000 0000 0000 ........
but loop with tcpdump372 ! :
12:26:57.540160 127.0.0.1 > 127.0.0.1: icmp: 127.0.0.1 protocol 132
unreachable for 127.0.0.1.10240 > 127.0.0.1.80: sctp
1) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
2) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
3) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
4) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
5) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
.......
but loop with tcpdump383 ! :
12:26:57.540160 IP (tos 0xc0, ttl 64, id 62246, offset 0, flags
[none], length: 72) 127.0.0.1 > 127.0.0.1: icmp 52: 127.0.0.1 protocol
132 unreachable for IP (tos 0x0, ttl 64, id 62247, offset 0, flags [none
], length: 44) 127.0.0.1.10240 > 127.0.0.1.80: sctp
1) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
2) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
3) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
4) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
5) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
6) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
7) [DATA] [TSN: 0] [SID: 0] [SSEQ 0] [PPID 0x3788c410] [Payload]
.......
Regards
Rmkml
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server.
Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
