Re: SMTP Preprocessor : X-ANONYMOUSTLS command

[<stephane.nasdrovisky () paradigmo com>]

More digging in the sources tells me:
The message more than x chars comes before checking for the commmand. You'll probably have to wait for version 3.

A different check for starttls and x-anonymoustls would be nice.

The file src/dynamic_preprocessors/snort_smtp.c contains

smtp_known_cmds
    "*"              CMD_ABORT
(there’s a starttls or ehlo command but no X- command)

SMTP_HandleCommand
    check for command line exceeding maximum
                SMTP_GenerateAlert(SMTP_COMMAND_OVERFLOW, "%s: more than %d chars",
                            SMTP_COMMAND_OVERFLOW_STR, smtp_eval_config->max_command_line_len);

        case CMD_ABORT:
            smtp_ssn->state_flags |= SMTP_FLAG_ABORT;

From: Dan Roberts 

My questions were regarding the way it is managed by snort......
  I'm getting continuously FP (I presume) alerts associated to SMTP traffic (124:1:1 (smtp) Attempted command buffer 
overflow: more than 512 chars).
I bet for a FP.

------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the 
conversation now. http://goparallel.sourceforge.net/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!