# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others. References in the rules themselves
# should be used for linking to other's work.
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
#
# $Id$
#
#
Rule:
--
Sid: 2329
--
Summary: A false positive is generated for SID 2329 by normal
HL(Half-Life)/TFC(Team Fortress Classic) game data traffic.
--
Impact: Serious. Immediate termination of game play to that particular game
server for the period of the block :(
--
Detailed Information: This is from the /var/log/snortsam log file:
2006/12/19, 21:48:14, 127.0.0.1, 2, snortsam, Blocking host 144.140.155.117
completely for 86400 seconds (Sig_ID: 2329).
This is from the /var/log/secure log file:
Dec 19 21:48:14 wilber snort[2805]: [1:2329:6] MS-SQL probe response overflow
attempt [Classification: Attempted User Privilege
Gain] [Priority: 1]: {UDP} 144.140.155.117:27025 -> 220.233.224.217:27005
By default, port 27015 is the default server port for the popular online game
Half-Life and its mods such as Team Fortress Classic.
By default, port 27005 is the default client port.
This don't trip all the time. Sometimes I can go for hours(like a 5 hour gaming
session), days or even weeks and not have a false
positive. But sometimes its bad and I can get several false positives within a
single night.
--
Affected Systems: Team Fortress Classic(a Half-Life mod) confirmed. Half-Life
and its other mods might also be affected.
--
Attack Scenarios:
--
Ease of Attack:
--
False Positives: This SID falsely indentifies the normal gaming traffic of the
Half-Life mod Team Fortress Classic as an MS-SQL
probe response overflow attempt.
--
False Negatives:
--
Corrective Action: Added the game server IP address to the exempt list.
--
Contributors: Matthew Williams <snort.org@wilber.pointclark.net>
--
Additional References: If you need any further information, like pcap, or a
tcpdump of a gaming session, please email me and ask.
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
