Hi, This is all the information that I can get at the moment.
=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=
=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+
=3D+
[**] [1:2048:7] MISC rsyncd overflow attempt [**]
[Classification: Misc activity] [Priority: 3]
[Xref =3D> http://www.securityfocus.com/bid/9153]
[Xref =3D> http://cve.mitre.org/cgi-bin/cvename.cgi?name=3D2003-0962]
[Xref =3D> http://cgi.nessus.org/plugins/dump.php3?id=3D11943]
Event ID: 32523 Event Reference: 32523
07/27/07-17:00:12.156547 10.0.1.1:33677 -> 10.0.2.1:873
TCP TTL:63 TOS:0x0 ID:63834 IpLen:20 DgmLen:288 DF
***AP*** Seq: 0xABCA28CE Ack: 0xF197F103 Win: 0xB058 TcpLen: 32
TCP Options (3) =3D> NOP NOP TS: 25104407 250732708
53 00 00 00 12 00 00 00 BC 02 00 00 79 02 00 00 S...........y...
FF FF FF FF FE FF FF FF FD FF FF FF FC FF FF FF ................
FB FF FF FF FA FF FF FF F9 FF FF FF F8 FF FF FF ................
F7 FF FF FF F6 FF FF FF F5 FF FF FF F4 FF FF FF ................
F3 FF FF FF F2 FF FF FF F1 FF FF FF F0 FF FF FF ................
EF FF FF FF EE FF FF FF 00 00 00 00 97 57 F9 E0 .............W..
DD 74 E9 3B 4C B6 D9 AD EB 0C D7 6C 54 00 00 00 .t.;L......lT...
14 00 00 00 BC 02 00 00 A0 01 00 00 FF FF FF FF ................
FE FF FF FF FD FF FF FF FC FF FF FF FB FF FF FF ................
FA FF FF FF F9 FF FF FF F8 FF FF FF F7 FF FF FF ................
F6 FF FF FF F5 FF FF FF F4 FF FF FF F3 FF FF FF ................
F2 FF FF FF F1 FF FF FF F0 FF FF FF EF FF FF FF ................
EE FF FF FF ED FF FF FF EC FF FF FF 00 00 00 00 ................
8D 04 EA 76 5B 4A 36 D3 09 92 71 DF C2 1C BC 7A ...v[J6...q....z
55 00 00 00 13 00 00 00 BC 02 00 00 U...........
=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=
=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+
=3D+
...
=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=
=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+
=3D+
[**] [1:2048:7] MISC rsyncd overflow attempt [**]
[Classification: Misc activity] [Priority: 3]
[Xref =3D> http://www.securityfocus.com/bid/9153]
[Xref =3D> http://cve.mitre.org/cgi-bin/cvename.cgi?name=3D2003-0962]
[Xref =3D> http://cgi.nessus.org/plugins/dump.php3?id=3D11943]
Event ID: 32527 Event Reference: 32527
07/27/07-17:00:12.167656 10.0.1.1:33677 -> 10.0.2.1:873
TCP TTL:63 TOS:0x0 ID:63837 IpLen:20 DgmLen:56 DF
***AP*** Seq: 0x98570CFE Ack: 0x5CFB4D8 Win: 0xBB08 TcpLen: 32
TCP Options (3) =3D> NOP NOP TS: 25104408 250732717
62 00 00 00 b...
=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=
=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+
=3D+
A tcpdump of one of the packets
No. Time Source Destination Protocol
Info
560 3.080514 10.0.1.1 10.0.2.1 RSYNC Data
Internet Protocol, Src: 10.0.1.1 (10.0.1.1), Dst: 10.0.2.1 (10.0.2.1),
Diff Serve: 0x00, Identification: 0x60b0, Flags: 0x04
Transmission Control Protocol, Src Port: 34584 (34584), Dst Port: 873
(873), Seq: 156507, Ack: 250218, Len: 12, Flags: 0x18, Window size:
5472, Checksum: 0x329b
RSYNC File Synchroniser
rsync data: D6000000BC02000022020000
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Hope this helps, let me know if you need more information.
-----Original Message-----
From: rmkml [mailto:rmkml@free.fr]
Sent: 30 July 2007 16:24
To: Christiaan Ehlers
Subject: RE: [Snort-sigs] rsync problem
Thx Christiaan,
possible send full packet and snort alert ?
Regards
Rmkml
On Tue, 31 Jul 2007, Christiaan Ehlers wrote:
Date: Tue, 31 Jul 2007 10:24:04 +0100
From: Christiaan Ehlers <Christiaan.Ehlers@inclarity.co.uk>
To: rmkml <rmkml@free.fr>, snort-sigs@lists.sourceforge.net
Subject: RE: [Snort-sigs] rsync problem
Client is: Redhat 7.3, i386
rsync version 2.5.4 protocol version 26
Server is: Fedora 6, i386
rsync version 2.6.9 protocol version 29
I can unfortunately not provide dumps directly from our production,
will
have to see if I can replicate this in the lab.
Here is some example Payload:
length =3D 16
000 : A8 00 00 00 38 01 00 00 BC 02 00 00 00 01 00 00
....8...........
length =3D 4
000 : A2 00 00 00 ....
length =3D 704
000 : 9F 00 00 00 A7 00 00 00 BC 02 00 00 C4 00 00 00
................
010 : FF FF FF FF FE FF FF FF FD FF FF FF FC FF FF FF
................
020 : FB FF FF FF FA FF FF FF F9 FF FF FF F8 FF FF FF
................
030 : F7 FF FF FF F6 FF FF FF F5 FF FF FF F4 FF FF FF
................
040 : F3 FF FF FF F2 FF FF FF F1 FF FF FF F0 FF FF FF
................
050 : EF FF FF FF EE FF FF FF ED FF FF FF EC FF FF FF
................
060 : EB FF FF FF EA FF FF FF E9 FF FF FF E8 FF FF FF
................
070 : E7 FF FF FF E6 FF FF FF E5 FF FF FF E4 FF FF FF
................
080 : E3 FF FF FF E2 FF FF FF E1 FF FF FF E0 FF FF FF
................
090 : DF FF FF FF DE FF FF FF DD FF FF FF DC FF FF FF
................
0a0 : DB FF FF FF DA FF FF FF D9 FF FF FF D8 FF FF FF
................
0b0 : D7 FF FF FF D6 FF FF FF D5 FF FF FF D4 FF FF FF
................
0c0 : D3 FF FF FF D2 FF FF FF D1 FF FF FF D0 FF FF FF
................
0d0 : CF FF FF FF CE FF FF FF CD FF FF FF CC FF FF FF
................
0e0 : CB FF FF FF CA FF FF FF C9 FF FF FF C8 FF FF FF
................
0f0 : C7 FF FF FF C6 FF FF FF C5 FF FF FF C4 FF FF FF
................
100 : C3 FF FF FF C2 FF FF FF C1 FF FF FF C0 FF FF FF
................
110 : BF FF FF FF BE FF FF FF BD FF FF FF BC FF FF FF
................
120 : BB FF FF FF BA FF FF FF B9 FF FF FF B8 FF FF FF
................
130 : B7 FF FF FF B6 FF FF FF B5 FF FF FF B4 FF FF FF
................
140 : B3 FF FF FF B2 FF FF FF B1 FF FF FF B0 FF FF FF
................
150 : AF FF FF FF AE FF FF FF AD FF FF FF AC FF FF FF
................
160 : AB FF FF FF AA FF FF FF A9 FF FF FF A8 FF FF FF
................
170 : A7 FF FF FF A6 FF FF FF A5 FF FF FF A4 FF FF FF
................
180 : A3 FF FF FF A2 FF FF FF A1 FF FF FF A0 FF FF FF
................
190 : 9F FF FF FF 9E FF FF FF 9D FF FF FF 9C FF FF FF
................
1a0 : 9B FF FF FF 9A FF FF FF 99 FF FF FF 98 FF FF FF
................
1b0 : 97 FF FF FF 96 FF FF FF 95 FF FF FF 94 FF FF FF
................
1c0 : 93 FF FF FF 92 FF FF FF 91 FF FF FF 90 FF FF FF
................
1d0 : 8F FF FF FF 8E FF FF FF 8D FF FF FF 8C FF FF FF
................
1e0 : 8B FF FF FF 8A FF FF FF 89 FF FF FF 88 FF FF FF
................
1f0 : 87 FF FF FF 86 FF FF FF 85 FF FF FF 84 FF FF FF
................
200 : 83 FF FF FF 82 FF FF FF 81 FF FF FF 80 FF FF FF
................
210 : 7F FF FF FF 7E FF FF FF 7D FF FF FF 7C FF FF FF
=7F...~...}...|...
220 : 7B FF FF FF 7A FF FF FF 79 FF FF FF 78 FF FF FF
{...z...y...x...
230 : 77 FF FF FF 76 FF FF FF 75 FF FF FF 74 FF FF FF
w...v...u...t...
240 : 73 FF FF FF 72 FF FF FF 71 FF FF FF 70 FF FF FF
s...r...q...p...
250 : 6F FF FF FF 6E FF FF FF 6D FF FF FF 6C FF FF FF
o...n...m...l...
260 : 6B FF FF FF 6A FF FF FF 69 FF FF FF 68 FF FF FF
k...j...i...h...
270 : 67 FF FF FF 66 FF FF FF 65 FF FF FF 64 FF FF FF
g...f...e...d...
280 : 63 FF FF FF 62 FF FF FF 61 FF FF FF 60 FF FF FF
c...b...a...`...
290 : 5F FF FF FF 5E FF FF FF 5D FF FF FF 5C FF FF FF
_...^...]...\...
2a0 : 5B FF FF FF 5A FF FF FF 59 FF FF FF 00 00 00 00
[...Z...Y.......
2b0 : 34 E8 4B BD 3B E3 4B 60 0F 84 66 FF 8E 28 03 56
4.K.;.K`..f..(.V
-----Original Message-----
From: rmkml [mailto:rmkml@free.fr]
Sent: 30 July 2007 02:42
To: Christiaan Ehlers
Subject: Re: [Snort-sigs] rsync problem
Hi Christiaan,
please send full payload and snort alert
and maybe send tcpdump trace on rsync session
what version of rsync client and server ? and on what platform ?
(os/hardware)
Regards
Rmkml
On Mon, 30 Jul 2007, Christiaan Ehlers wrote:
Date: Mon, 30 Jul 2007 19:21:26 +0100
From: Christiaan Ehlers <Christiaan.Ehlers@inclarity.co.uk>
To: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] rsync problem
Hi thanks for the response, It's a bit of a dumb error on my side!
Now I have the problem that I get a lot of false possitives on my
rsync.
All the rsync traffic is legit (I am very sure of this since I
personally triggerd all the alerts from my rsync client!)...
Could this be due to little/big endian issue between the client and
server? Anybody know the format of the rsync packet?
-----Original Message-----
From: snort-sigs-bounces@lists.sourceforge.net
[mailto:snort-sigs-bounces@lists.sourceforge.net] On Behalf Of Nigel
Houghton
Sent: 30 July 2007 19:12
To: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] rsync problem
On 0, Christiaan Ehlers <Christiaan.Ehlers@inclarity.co.uk> wrote:
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3=
D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D
=3D3D
length =3D3D 4
000 : A4 00 00 00 ....
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3=
D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D
=3D3D
If we step through this rule we see that first 2 bytes are A4
which
is
not more than 4000! The rest of the rule is satisfied though...
The first two bytes are "A4 00" which is decimal 41984.
--
Nigel Houghton
Office Linebacker
SF VRT
------------------------------------------------------------------------
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a
browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
Disclaimer=3D0A=3D
=3D0A=3D
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
=3D3D=3D
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
3D=3D3D=3D3D=3D0A=3D
=3D0A=3D
This email and any files transmitted with it are confidential and=3D0A=3D
intended solely for the use of the individual or entity to whom
they=3D0A=3D
are addressed. If you have received this email in error please
notify=3D0A=3D
the system manager. Please note that any views or opinions
presented=3D0A=3D
in this email are solely those of the author and do not
necessarily=3D0A=3D
represent those of the company. Finally, the recipient should
check=3D0A=3D
this email and any attachments for the presence of viruses. The=3D0A=3D
company accepts no liability for any damage caused by any virus=3D0A=3D
transmitted by this email.=3D0A=3D
=3D0A=3D
=3D0A=3D
Inclarity Ltd.=3D0A=3D
=3D0A=3D
Registered Office: Olympic Office Centre, Fulton Road, Wembley, =3D0A=3D
Middlesex, HA9 0NU=3D0A=3D
Telephone: + 44 (0)845 698 0800=3D0A=3D
Fax: + 44 (0)845 698 1000=3D0A=3D
=3D0A=3D
Registered Company No. 02673204=3D0A=3D
=3D0A=3D
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
=3D3D=3D
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D=
3D=3D3D=3D3D
------------------------------------------------------------------------
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a
browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
Disclaimer
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager. Please note that any views or opinions presented
in this email are solely those of the author and do not necessarily
represent those of the company. Finally, the recipient should check
this email and any attachments for the presence of viruses. The
company accepts no liability for any damage caused by any virus
transmitted by this email.
Inclarity Ltd.
Registered Office: Olympic Office Centre, Fulton Road, Wembley,
Middlesex, HA9 0NU
Telephone: + 44 (0)845 698 0800
Fax: + 44 (0)845 698 1000
Registered Company No. 02673204
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Disclaimer=0A=
=0A=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A=
=0A=
This email and any files transmitted with it are confidential and=0A=
intended solely for the use of the individual or entity to whom they=0A=
are addressed. If you have received this email in error please notify=0A=
the system manager. Please note that any views or opinions presented=0A=
in this email are solely those of the author and do not necessarily=0A=
represent those of the company. Finally, the recipient should check=0A=
this email and any attachments for the presence of viruses. The=0A=
company accepts no liability for any damage caused by any virus=0A=
transmitted by this email.=0A=
=0A=
=0A=
Inclarity Ltd.=0A=
=0A=
Registered Office: Olympic Office Centre, Fulton Road, Wembley, =0A=
Middlesex, HA9 0NU=0A=
Telephone: + 44 (0)845 698 0800=0A=
Fax: + 44 (0)845 698 1000=0A=
=0A=
Registered Company No. 02673204=0A=
=0A=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
