Snort mailing list archives
MS-SQL Probe when listening to streaming radio! ???
From: "Jeffery Gunter" <jgunter () cbetn com>
Date: Wed, 29 Mar 2006 08:53:46 -0500
Hi Folks; I'm quite new to snort. I have a user using Win Media Player to listen to streaming radio from WIMZ out of Knoxville, TN. My issue is that it is causing snort to go crazy. I've received over 100 of the following messages: IDS:S=snort:ID=1:[1:2329:6] MS-SQL probe response overflow attempt [Classification: Attempted User Privilege Gain] [Priority: 1]: {UDP} 66.250.188.37:2267 -> 10.88.220.65:1215 My user's ip is 65 and when I had her stop accessing the stream the messages stopped? What is up with this? I have no SQL services running on her computer? Thanks for your help! :-) Jeffery Gunter | Chief Information Officer | Citizens Bank of East Tennessee | http://www.cbetn.com <BLOCKED::http://www.cbetn.com/> email: jgunter () cbetn com <BLOCKED::mailto:jgunter () cbetn com> Land: 423-272-2200 x17 Cell: 423-754-5157 Fax: 423-272-2322 This e-mail was scanned for viruses.
Current thread:
- MS-SQL Probe when listening to streaming radio! ??? Jeffery Gunter (Mar 29)
- Re: MS-SQL Probe when listening to streaming radio! ??? Paul Schmehl (Mar 29)
- Re: MS-SQL Probe when listening to streaming radio! ??? Andrew (Mar 29)
- <Possible follow-ups>
- RE: MS-SQL Probe when listening to streaming radio! ??? Briggs, Bruce (Mar 29)
- Re: MS-SQL Probe when listening to streaming radio! ??? Joel Esler (Mar 29)