Le Lundi 21 Novembre 2005 09:52, Chich Thierry a écrit :
I have a lot of FP for this rule.
Some additional indications:
the rule is
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg: "COMMUNITY
WEB-MISC mod_jrun overflow attempt"; flow:to_server,established; content:"|
3A|"; pcre:"/^.*\x3a[^\n]{1000}/sm"; reference:bugtraq,11245;
reference:cve,2004-0646; classtype:web-application-attack; sid:100000122;
rev:1;)
It overreact when a data flow is downloaded from the web site.
For instance, this packet:
0x0030: c39d 5fc2 f53b e1d2 9d70 e92e f06b f01b .._..;...p...k..
0x0040: c2bf 05f7 f2dd 5ed2 d94b fa7b 91da bd48 ......^..K.{...H
0x0050: c95e 459f 757f 47f8 77c4 dfcf f7fb 4977 .^E.u.G.w.....Iw
0x0060: 3fd2 b09f f9d6 7ee6 93fb 9967 7ec7 ded5 ?.....~....g~...
0x0070: 5e76 40bf 8557 bf01 7781 5f12 be1d dcc6 ^v@..W..w._.....
0x0080: 77db d8f3 da4e 7a5f 92fe 4ee6 79bb 98ff w....Nz_..N.y...
0x0090: 7d43 fedf 42cf 5e30 cd04 169e 639e f775 }C..B.^0....c..u
0x00a0: 8f48 6757 e3fd c84c d65a 02b6 fd83 76bb .HgW...L.Z....v.
0x00b0: fe3a bce6 f985 68d7 6874 cf14 e42c 41de .:....h.ht...,A.
0x00c0: 914c 33d1 6f5e c939 4663 c72d 3d92 ec65 .L3.o^.9Fc.-=..e
0x00d0: a5a8 959e ce27 748c 3c75 5c39 4b49 51a8 .....'t.<u\9KIQ.
0x00e0: ef1e cb4b 2b49 2678 7d45 c7d1 fb55 eeb9 ...K+I&x}E...U..
0x00f0: 85f4 1669 26d8 0f93 dd5e 59d9 a581 a257 ...i&....^Y....W
0x0100: a1f5 0bb3 d44f ce35 821a fe89 9989 c60f .....O.5........
0x0110: c18d e0c7 e0a7 e067 e036 f04b f02b c7bd .......g.6.K.+..
0x0120: 8db6 fd02 fc14 fcd8 c9c7 e6fb 0b33 265b .............3&[
0x0130: 2516 e3e0 9538 dcd6 eab5 8d97 a0f0 4370 %....8........Cp
0x0140: 23e1 1f13 ff13 d2f9 9474 856e 3b96 fd0c #........t.n;...
0x0150: da70 8b1e 68bf ff8c f42c bdd6 caf5 36d0 .p..h....,....6.
0x0160: f61a 89a0 b576 6dcb 575f e10e 787a 07ee .....vm.W_..xz..
0x0170: 6d26 5adb a349 acd2 d543 a4ab 73a9 f132 m&Z..I...C..s..2
0x0180: a881 0c72 d46e d75f 8787 183f bc5a df17 ...r.n._...?.Z..
0x0190: 3191 1593 ff27 6b9d 9033 933b 96d5 1719 1....'k..3.;....
0x01a0: 3ff5 9942 9053 6d34 7e08 6e04 ff0d 7e02 ?..B.Sm4~.n...~.
0x01b0: 7e0a 7e06 7e01 6e73 cab6 cd44 9fea c7fc ~.~.~.ns...D....
0x01c0: 3253 cf48 6d97 f9b5 6d5f deb0 1699 5f27 2S.Hm...m_...._'
0x01d0: 4771 bbfe 3a3c c44a c78b ac6c 6ad2 547b Gq..:<.J...lj.T{
0x01e0: ed07 5f48 5a6e 9eda ff75 13ad 5f5e 27d6 .._HZn...u.._^'.
0x01f0: d21f 1729 3d36 b3ff 19f6 2ca4 9eb5 dbf5 ...)=6....,.....
0x0200: d7e1 35ef d827 3ba8 570d a25f 11a7 7a5e ..5..';.W.._..z^
0x0210: 8973 2c9e 73ef 84e9 bbf6 dad2 508a 89b6 .s,.s.......P...
0x0220: e49c 66a2 6dc5 a6ab ff7d 9e15 8a5b 5016 ..f.m....}...[P.
0x0230: c11c 7aa4 2660 363d 5323 783a 135e ce84 ..z.&`6=S#x:.^..
0x0240: 9733 e1e5 4c78 b911 bc9c 0d2f 37a5 ce72 .3..Lx...../7..r
0x0250: c016 604b b095 421b bfb5 c2cf a8fb 2d26 ..`K..B.......-&
0x0260: fafe 74cc 77ec 7b45 5abf 93f1 a495 7b22 ..t.w.{EZ.....{"
0x0270: 6dda edfa eb70 bff5 f55b d37a 7d17 6f02 m....p...[.z}.o.
0x0280: ab09 0d4c f44d d744 6766 5d9b 66ed 7fdb ...L.M.Dgf].f...
0x0290: fbd1 bbae ee8b 43ee 6c34 d5d4 7cbb 25d5 ......C.l4..|.%.
0x02a0: 44db fc96 fb61 0926 3841 157b a4ff cd2a D....a.&8A.{...*
0x02b0: 8f3e 41d5 36bf eb45 5611 5243 5de0 22c1 .>A.6..EV.RC].".
0x02c0: ce70 5925 d809 2c05 3b82 ede1 c222 be6b .pY%..,.;....".k
0x02d0: 4bcf 5a08 3716 322e 16c2 8585 8a7b bee0 K.Z.7.2......{..
0x02e0: bb6d a4b3 83f4 2d96 e3df 9978 5dc0 ee70 .m....-....x]..p
0x02f0: 5d77 b8bb 27f9 f424 dfee d0d5 0dec 0c4f ]w..'..$.......O
0x0300: 5482 e560 2958 0cfd c5d0 5f4c 3a1d c16c T..`)X...._L:..l
0x0310: e717 1377 f78e 7077 85f1 8ee7 7d8a 1328 ...w..pw....}..(
0x0320: b176 bbfe 3a3c 0497 7911 4eab 530b d671 .v..:<..y.N.S..q
0x0330: 6691 f56a 99a5 1a13 7dfb a48e a979 db44 f..j....}....y.D
0x0340: acf2 b431 81e5 b638 fcb5 0538 fff6 8550 ...1...8...8...P
0x0350: d417 5a35 ae03 5f03 ff06 be03 fe93 327e ..Z5.._.......2~
0x0360: 08fe 1bff 2de0 67e0 3670 87aa a313 f03f ....-.g.6p.....?
0x0370: 012e 3941 6655 26da 2a79 4cad 777c a4f5 ..9AfU&.*yL.w|..
0x0380: 2a8d 7772 3887 b7c2 9e97 c0d7 daed faeb *.wr8...........
0x0390: f09a fb59 5a5e 45a7 5aef 8aca 6a5c 2cb4 ...YZ^E.Z...j\,.
0x03a0: c809 90ac d665 f5ae e7e9 b23b 2aab 7ed9 .....e.....;*.~.
0x03b0: 0d90 5d02 4fad 21f4 aea8 e78c e47a f6a5 ..].O.!......z..
0x03c0: 6f26 eb93 266d 8359 eb4b 8b8d 3dad 872c o&..&m.Y.K..=..,
0x03d0: 964e 2d36 03f5 ab89 fead 04a9 9993 914d .N-6...........M
0x03e0: c181 c8e8 40b8 e474 f04c f077 e059 e0ef ....@..t.L.w.Y..
0x03f0: c173 f8ee 3cd2 398f bec1 e23f c077 88ff .s..<.9....?.w..
0x0400: 77d2 798b 742d 9e86 ff29 c43b 85ef 4e26 w.y.t-...).;..N&
0x0410: 9d53 48f7 14f2 1b48 9f74 3a5c 7c26 7de0 .SH....H.t:\|&}.
0x0420: efe9 b3ce 8127 8680 1782 1781 7f02 2f21 .....'......../!
0x0430: fe25 7caf 4ff2 631e 69fb 44b8 b9b3 f106 .%|.O.c.i.D.....
0x0440: 861b b504 2bc4 03c2 a8dd aebf 0ef7 f9e3 ....+...........
0x0450: b470 9b9d 760c 6ef6 1c6e 11dd 54e1 1aad .p..v.n..n..T...
0x0460: 93aa 35f0 6507 5a38 49ce 0db5 e6bd bcdf ..5.e.Z8I.......
0x0470: 579b 8ead f4d5 59ce ec3c dde1 dcfa 70b7 W.....Y..<....p.
0x0480: ac8c f5f9 aad0 27ba b359 26d0 fe4f 32c1 ......'..Y&..O2.
0x0490: db7f 4d49 afa9 09f6 b7d2 4d70 834d 6e78 ..MI......Mp.Mnx
0x04a0: e8db d0fa 769b 58da 91b3 55b9 4990 6082 ....v.X...U.I.`.
0x04b0: 33d9 3c13 58f1 ae6b a2df 25ac 6ffc bd32 3.<.X..k..%.o..2
0x04c0: 7943 21dd 445b f596 3705 b405 1bed 96f0 yC!.D[..7.......
0x04d0: 0c13 6d15 3cd9 0496 825a 8362 e9b3 2d28 ..m.<....Z.b..-(
0x04e0: affd 149b c0be b2f5 2f55 2876 95eb 9ac0 ......../U(v....
0x04f0: 0e71 29f9 9492 6f29 f496 4257 0974 9650 .q)...o)..BW.t.P
0x0500: 5762 f7b7 142c 8fb4 b570 9ee5 c92a 2fc0 Wb...,...p...*/.
0x0510: 53c3 d82d 8ca7 87b1 07d8 338c 83c0 b3c3 S..-......3.....
0x0520: d88b 7709 7af1 2e41 2fde 23e8 c97b 043d ..w.z..A/.#..{.=
0x0530: 7887 a02b ef10 54f1 ee40 0558 0e96 f13e x..+..T..@.X...>
0x0540: 4147 e295 f05d 47d2 e948 ba65 e453 41be AG...]G..H.e.SA.
0x0550: 95bc 8fd0 15ec 065d 425f 6fb0 2f78 22f1 .......]B_o./x".
0x0560: faf3 fd49 a477 12ef 290c 209f 93c8 f724 ...I.w..)......$
0x0570: e8e8 0f5d 2742 6f6f de4d e8c5 7b00 ddc0 ...]'Boo.M..{...
0x0580: 2ab0 02b4 e5bb 02f7 15d0 7b05 *.........{.
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
Register for a JBoss Training Course. Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
Register for a JBoss Training Course. Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_idv28&alloc_id845&opÌk
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
