On 0, Matt Jonkman <matt@infotex.com> allegedly wrote:
No docs on this sig, so not sure what to compare to. Getting a ton of
false positives on very normal print jobs:
000 : 1D 03 7D B1 02 02 43 54 58 40 28 08 16 14 15 00 ..}...CTX@(.....
010 : 0C 0F 10 02 55 00 0E 0C 0F 10 02 55 0E 0C 0D 0D ....U......U....
020 : 02 55 0E 15 30 40 00 01 20 00 30 00 02 00 00 10 .U..0@.. .0.....
030 : 00 02 00 B8 FF C0 B4 13 14 02 55 00 B8 FF C0 40 ..........U....@
040 : 11 11 11 02 55 00 00 0B 1B 25 11 07 00 07 10 07 ....U....%......
050 : 02 07 B8 FF C0 B4 0F 10 02 55 07 B8 FF C0 B5 13 .........U......
060 : 14 02 55 07 04 B8 FF D6 B4 13 14 02 55 04 B8 FF ..U.........U...
070 : CA B7 12 12 02 55 04 31 0B 0B 00 3F ED 2B 2B C4 .....U.1...?.++.
080 : 2B 2B 5D 3F ED 12 39 2F 2B 2B 5D 5D 5D ED 01 2F ++]?..9/++]]]../
090 : 2B 2B DD 2B C0 2F CD C0 31 30 1B B1 06 02 43 54 ++.+./..10....CT
0a0 : 58 40 1D 15 80 00 A0 00 B0 00 03 20 00 30 00 40 X@......... .0.@
0b0 : 00 03 00 00 10 00 02 00 00 0B 1B 25 11 07 08 07 ...........%....
0c0 : B8 FF C0 40 24 10 10 06 55 10 07 20 07 B0 07 03 ...@$...U.. ....
0d0 : 00 07 60 07 80 07 A0 07 04 07 92 04 A2 04 B2 04 ..`.............
0e0 : 03 04 31 0B 0B 07 08 16 14 B8 FF F4 40 26 0D 0D ..1.........@&..
0f0 : 06 55 14 14 1F 1E 15 00 0C 0D 0D 06 55 00 0C 0F .U..........U...
100 : 0F 06 55 00 0E 0C 0F 0F 06 55 0E 16 0D 0D 06 55 ..U......U.....U
110 : 0E 0E 1F 1E 11 12 39 2F 2B 2B DD 2B 2B C0 11 12 ......9/++.++...
120 : 39 2F 2B CD D0 CD 00 3F ED 5D C4 5D 5D 2B 32 3F 9/+....?.].]]+2?
130 : ED 12 39 2F 5D 5D 5D CD 31 30 1B 40 19 12 5F 18 ..9/]]].10.@.._.
140 : 5D 19 60 00 60 14 D6 03 05 19 20 1C 39 17 20 1C ].`.`..... .9. .
150 : 39 16 40 1C 39 1F B8 FF C0 40 0A 43 4A 34 08 1F 9.@.9....@.CJ4..
160 : 43 0D 5D 36 1F B8 FF C0 B3 28 28 34 1F B8 FF C0 C.]6.....((4....
170 : 40 53 2A 2E 34 1B 06 19 09 58 13 5E 16 5F 17 5A @S*.4....X.^._.Z
180 : 18 5B 1A 07 01 03 09 06 07 09 08 0C 05 15 49 06 .[............I.
190 : 89 02 8C 06 87 0C 8A 10 85 1D A3 02 AB 18 B5 13 ................
1a0 : D4 02 D9 0F DA 10 F4 02 F3 03 13 12 60 07 60 08 ............`.`.
1b0 : 70 07 80 07 89 09 C1 07 C8 0F F0 07 08 04 01 07 p...............
1c0 : 0D 84 02 03 09 BA FF E0 00 06 FF E0 40 4A 36 09 ............@J6.
1d0 : 46 02 47 09 4F 1F 54 02 54 09 62 02 72 02 89 13 F.G.O.T.T.b.r...
1e0 : 89 19 99 13 A4 09 A4 0A B8 08 B5 09 B0 0A C7 02 ................
1f0 : E7 02 E0 0C F4 0A 14 08 D0 07 01 00 07 D0 07 02 ................
200 : 71 07 01 00 07 10 07 20 07 90 07 A0 07 B0 07 06 q...... ........
210 : 07 7D 04 14 00 30 16 15 .}...0..
What are we supposed to be looking for here?
Apologies for not getting the docs out for this, here is the Detail
section for the rule:
Detailed Information:
A vulnerability exists in the Solaris operating system that may allow an
unprivileged use to remove any file on a system using the line printer
daemon. This can be done via the Unlink command which can be used to
unlink any file on a local or remote sytem accepting connections to lpd.
Solaris offers a printer daemon in.lpd that allows network users to
print jobs over the network. The receive printer job function allows a
user to supply job control information for the print job. A flaw exists
in code that checks the job control information for a supplied file name
to be deleted. It does not make sure that the supplied file name is
located in the default printer queue directory, permitting arbitrary
files to be deleted.
The 'U' command instructs the LPD to unlink a file on completion of a
printing job. By supplying this command in an instruction to the LPD,
an attacker is able to remove any file on the remote system.
+--------------------------------------------------------------------+
Nigel Houghton Research Engineer Sourcefire Inc.
Vulnerability Research Team
I require a window seat and an inflight Happy Meal, and no pickles!
God help you if I find pickles!
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
