Re: WEB-CLIENT Excel malformed FBI record - False positive?

[Joel Esler <joel.esler () mac com>]

Do you have two HOME_NET lines in your snort.conf file?  I'm not  
saying anything bad or anything, but it looks like to me that you have  
two HOME_NET definitions.

J

On Jul 8, 2008, at 9:49 AM, Jesper Skou Jensen wrote:

> Jack Pepper wrote:
> > > If this was how you imagined our setup then please try to explain  
> > > the
> > > above in another way.
> >
> > Starting over ....
>
> Good idea. :-)
>
> > I believe your IP address obfuscation is blurring the analysis.
> > Please repost the rule definition and the original packet again.   
> > This
> > time change only the second octet of the IP addresses.  Defining both
> > ends of the conversation as both being on the "10." network is messy.
> > We'll just start over.
>
>
> alert
> Jul  7 13:37:00 syslogserver snort: [1:12256:1] WEB-CLIENT Excel
> malformed FBI record [Classification: Attempted User Privilege Gain]
> [Priority: 1]: {TCP} 80.xx.86.40:80 -> 195.xx.18.18:15968
>
>
> rules/web-client.rules
> alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT
> Excel malformed FBI record"; flow:from_server,established;
> flowbits:isset,xls.download; content:"`|10|";
> byte_test:2,>,32767,6,relative; reference:cve,2007-1203;
> reference:url,www.microsoft.com/technet/security/bulletin/ms07-023.mspx 
> ;
> classtype:attempted-user; sid:12256; rev:1;)
>
>
> > Also please include the following line from your snort.conf:  "var
> > HOME_NET ... "
>
> var HOME_NET 80.xx.86.0/24
>
>
>
> 80.xx.86.40 = Our webserver on our lan, behind (next to) the Snort box
> 195.xx.18.18 = Some client on the Internet
>
>
> -- 
>
>   Jesper S. Jensen
> Basisnet og Sikkerhed
> Uni-C - Århus, Danmark
>
>
> -------------------------------------------------------------------------
> Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
> Studies have shown that voting for your favorite open source project,
> along with a healthy diet, reduces your potential for chronic lameness
> and boredom. Vote Now at http://www.sourceforge.net/community/cca08
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


--
Joel Esler
  http://blog.joelesler.net
  http://www.dearcupertino.com
[m]




-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users