Some additional information:
Version of snort used: 2.6.1.2
Snort.conf configuration:
var HOME_NET [192.168.247.133/32]
var EXTERNAL_NET !$HOME_NET
[..]
Preprocessors: frag3, stream4, http_inspect
Command-line options when starting snort:
snort -u snort -r uid.pcap -l log/ -c snort.conf
Operating system used: Gentoo linux
Attached a sample PCAP file. A client (192.168.247.129) retrieves a website
from the server (192.168.247.133) with the string "uid=33(www-data)
gid=33(www-data) groups=33(www-data)".
On 4/5/07, Cees <celzinga@gmail.com> wrote:
Hi list,
The rule "ATTACK-RESPONSES id check returned userid" will generate false
negatives. The complete rule is:
alert ip $HOME_NET any -> $EXTERNAL_NET any (msg:"ATTACK-RESPONSES id
check returned userid"; content:"uid=";
byte_test:5,<,65537,0,relative,dec,string; content:" gid="; within:15;
byte_test:5,<,65537,0,relative,dec,string; classtype:bad-unknown; sid:1882;
rev:12;)
Same examples:
uid=0(root) gid=0(root) groups=0(root) -> works
uid=1001(cees) gid=1001(cees) groups=1001(cees) -> works
uid=33(www-data) gid=33(www-data) groups=33(www-data) -> false negative
The false negative is caused by the within argument. "uid=" and " gid="
are separated by a total of 17 characters.
uid=33(www-data) gid=33(www-data) groups=33(www-data)
<------------->
15
<--------------->
17
The current within setting will cause the rule to fail for every user
where the combined length of the uid and username is greater then 9.
Suggested solution is to increase the within setting to approx 25/30.
Any thoughts?
Cheers, Cees
(BTW in it's default configuration this rule is currently disabled. Most
likely because of the high probability of false positives from admins.)
uid.pcap
Description: application/force-download
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
