0, snort-users-request@lists.sourceforge.net:
Today's Topics:
1. MS-SQL Probe when listening to streaming radio! ??? (Jeffery Gunter)
--__--__--
Message: 1
Date: Wed, 29 Mar 2006 08:53:46 -0500
From: "Jeffery Gunter" <jgunter@cbetn.com>
To: <snort-users@lists.sourceforge.net>
Subject: [Snort-users] MS-SQL Probe when listening to streaming radio! ???
Hi Folks;=20
I'm quite new to snort. I have a user using Win Media Player to listen
to streaming radio from WIMZ out of Knoxville, TN. My issue is that it
is causing snort to go crazy. I've received over 100 of the following
messages:=20
IDS:S=3Dsnort:ID=3D1:[1:2329:6] MS-SQL probe response overflow attempt
[Classification: Attempted User Privilege Gain] [Priority: 1]: {UDP}
66.250.188.37:2267 -> 10.88.220.65:1215=20
My user's ip is 65 and when I had her stop accessing the stream the
messages stopped? What is up with this? I have no SQL services running
on her computer?=20
Thanks for your help!
Your first stop when looking at what might be happening is the document
associated with the rule.
You will find the docs both on snort.org[0] and in the doc/signatures
directory of the snort source. (each rule has an associated doc)
In the doc, you should see this:
False Positives:
Since this rule cannot be constrained using ports and the connection
state for MSDAC is not tracked, false positive events may occur under
normal circumstances. The $SQL_SERVERS variable in snort.conf should be
configured correctly to eliminate this behavior.
That might help you out.
[0] http://www.snort.org/pub-bin/sigs.cgi?sid=2329
The docs appear to be slightly out of sync with the latest versions,
apologies, we'll fix that shortly.
+--------------------------------------------------------------------+
Nigel Houghton Research Engineer Sourcefire Inc.
Vulnerability Research Team
There is no theory of evolution, just a list
of creatures Vin Diesel allows to live.
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
