Rule: SHELLCODE x86 NOOP (NOP Sled)
--
Sid: 648
--
Summary: When I use MS Enterprise Manager from inside my network to
connect to a remote DB outside of my network (via internet) SNORT
attempts to block the remote DB's IP address.
--
Impact: Other web services, servers, and programs attempting to access
the DB at the same IP address are blocked from accessing the DB.
--
Detailed Information: We used Snort all weekend, with IIS servers having
no problem accessing a remote DB. When I arrived at work at 7:30 AM and
started Enterprise Manager the IP address to the DB was blocked.
--
Affected Systems:
--
Attack Scenarios:
--
Ease of Attack:
--
False Positives: Using Enterprise Manager creates NOPs
--
False Negatives:
--
Corrective Action: Added the DB's IP address to white list. The DB is
the only resource at that IP address.
--
Contributors:
--
Additional References:
David Schedler
Trinity Real Estate Solutions, Inc.
972-865-0215
972-865-0219 (fax)
www.TrinityInspection.com
Privileged or confidential information may be contained in this message.
If you have received it in error, you may not forward, copy or deliver
this message to anyone or disclose its contents to any other person. If
you are not the intended recipient, please destroy this message and
kindly notify the sender by reply email. Thank you for your cooperation
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier.
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
