Snort mailing list archives
Re: DOS MSDTC attempt
From: Kenny D <bitored2002 () yahoo com au>
Date: Wed, 17 Apr 2002 23:46:13 +1000 (EST)
Thanks for the reply, So if the destination ip doesnt have 3372 open i can write a pass rule. So why does it matter if its a switched network or not? Rgds, Kenny. --- Andreu.Gomez () keisa intrakom com wrote: >
If you look at that rule, you will see that the alert is triggered when there's a connection to port 3372 and the payload is bigger than 1023. This is because there is a bug in M$ systems that can be exploited by sending 1024 bytes to port 3372, the M$ Distributed Transaction Coordinator. The rule is: alert tcp $EXTERNAL_NET any -> $HOME_NET 3372 (msg:"DOS MSDTC attempt"; flags:A+; dsize:>1023; reference:bugtraq,4006; classtype:attempted-dos; sid:1408; rev:2;) Check
http://online.securityfocus.com/cgi-bin/vulns-item.pl?section=discussion&id=4006
for more details. This doesn't mean that you are under a DOS attack, but I would review your snort setup, so that rule is not applied for your users network (if you are in a switched environment), or wrote a pass rule for machines not running vulnerable services. Andreu
http://messenger.yahoo.com.au - Yahoo! Messenger - A great way to communicate long-distance for FREE! _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- DOS MSDTC attempt Kenny D (Apr 17)
- <Possible follow-ups>
- Re: DOS MSDTC attempt Kenny D (Apr 17)
- Re: DOS MSDTC attempt Andreu . Gomez (Apr 17)