Snort mailing list archives
Re: MS-SQL Probe when listening to streaming radio
From: Nigel Houghton <nigel () sourcefire com>
Date: Wed, 29 Mar 2006 13:44:42 -0600
0, snort-users-request () lists sourceforge net:
Today's Topics: 1. MS-SQL Probe when listening to streaming radio! ??? (Jeffery Gunter)
--__--__-- Message: 1 Date: Wed, 29 Mar 2006 08:53:46 -0500 From: "Jeffery Gunter" <jgunter () cbetn com> To: <snort-users () lists sourceforge net> Subject: [Snort-users] MS-SQL Probe when listening to streaming radio! ??? Hi Folks;=20 I'm quite new to snort. I have a user using Win Media Player to listen to streaming radio from WIMZ out of Knoxville, TN. My issue is that it is causing snort to go crazy. I've received over 100 of the following messages:=20 IDS:S=3Dsnort:ID=3D1:[1:2329:6] MS-SQL probe response overflow attempt [Classification: Attempted User Privilege Gain] [Priority: 1]: {UDP} 66.250.188.37:2267 -> 10.88.220.65:1215=20 My user's ip is 65 and when I had her stop accessing the stream the messages stopped? What is up with this? I have no SQL services running on her computer?=20 Thanks for your help!
Your first stop when looking at what might be happening is the document associated with the rule. You will find the docs both on snort.org[0] and in the doc/signatures directory of the snort source. (each rule has an associated doc) In the doc, you should see this: False Positives: Since this rule cannot be constrained using ports and the connection state for MSDAC is not tracked, false positive events may occur under normal circumstances. The $SQL_SERVERS variable in snort.conf should be configured correctly to eliminate this behavior. That might help you out. [0] http://www.snort.org/pub-bin/sigs.cgi?sid=2329 The docs appear to be slightly out of sync with the latest versions, apologies, we'll fix that shortly. +--------------------------------------------------------------------+ Nigel Houghton Research Engineer Sourcefire Inc. Vulnerability Research Team There is no theory of evolution, just a list of creatures Vin Diesel allows to live. ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: MS-SQL Probe when listening to streaming radio Nigel Houghton (Mar 29)