Snort mailing list archives
RE: MS-SQL Probe when listening to streaming radio! ???
From: "Briggs, Bruce" <Bruce.Briggs () suny edu>
Date: Wed, 29 Mar 2006 10:07:03 -0500
In your snort.conf, the default value for your SQL servers is: var SQL_SERVERS $HOME_NET Replace $HOME_NET with the actual IP addrs of any internal SQL servers. Or comment out the alert for SID 2329 in sql.rules. Then you won't see these false positives any more. Many use Oinkmaster to manage commented out alerts across Snort signature updates. Bruce ________________________________ From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Jeffery Gunter Sent: Wednesday, March 29, 2006 8:54 AM To: snort-users () lists sourceforge net Subject: [Snort-users] MS-SQL Probe when listening to streaming radio! ??? Hi Folks; I'm quite new to snort. I have a user using Win Media Player to listen to streaming radio from WIMZ out of Knoxville, TN. My issue is that it is causing snort to go crazy. I've received over 100 of the following messages: IDS:S=snort:ID=1:[1:2329:6] MS-SQL probe response overflow attempt [Classification: Attempted User Privilege Gain] [Priority: 1]: {UDP} 66.250.188.37:2267 -> 10.88.220.65:1215 My user's ip is 65 and when I had her stop accessing the stream the messages stopped? What is up with this? I have no SQL services running on her computer? Thanks for your help! :-) Jeffery Gunter | Chief Information Officer | Citizens Bank of East Tennessee | http://www.cbetn.com <BLOCKED::http://www.cbetn.com/> email: jgunter () cbetn com <BLOCKED::mailto:jgunter () cbetn com> Land: 423-272-2200 x17 Cell: 423-754-5157 Fax: 423-272-2322 ------_>extPart_001_01C65338.3329CF40-- This e-mail was scanned for viruses.
Current thread:
- MS-SQL Probe when listening to streaming radio! ??? Jeffery Gunter (Mar 29)
- Re: MS-SQL Probe when listening to streaming radio! ??? Paul Schmehl (Mar 29)
- Re: MS-SQL Probe when listening to streaming radio! ??? Andrew (Mar 29)
- <Possible follow-ups>
- RE: MS-SQL Probe when listening to streaming radio! ??? Briggs, Bruce (Mar 29)
- Re: MS-SQL Probe when listening to streaming radio! ??? Joel Esler (Mar 29)