Re: DOS MSDTC attempt

[Kenny D <bitored2002 () yahoo com au>]

Thanks for the reply,

So if the destination ip doesnt have 3372 open i can
write a pass rule. So why does it matter if its a
switched network or not?

Rgds,

Kenny. 

--- Andreu.Gomez () keisa intrakom com wrote: > 
> If you look at that rule, you will see that the
> alert is triggered when
> there's a  connection to port  3372 and the payload
> is bigger than 1023.
> This is because there is a bug in M$ systems that
> can be exploited by
> sending 1024 bytes to port 3372, the M$ Distributed
> Transaction
> Coordinator.
> The rule is:
>
> alert tcp $EXTERNAL_NET any -> $HOME_NET 3372
> (msg:"DOS MSDTC attempt";
> flags:A+; dsize:>1023; reference:bugtraq,4006;
> classtype:attempted-dos;
> sid:1408; rev:2;)
>
> Check
http://online.securityfocus.com/cgi-bin/vulns-item.pl?section=discussion&id=4006
> for more details.
> This doesn't mean that you are under a DOS attack,
> but I would review your
> snort setup, so that rule is not applied for your
> users network (if you are
> in a switched environment), or wrote a pass rule for
> machines not running
> vulnerable services.
>
> Andreu
>  

http://messenger.yahoo.com.au - Yahoo! Messenger
- A great way to communicate long-distance for FREE!

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users