Re: SMTP Preprocessor question

[James Lay <jlay () slave-tothe-box net>]

I believe you are correct. 

James 

On 2015-11-24 08:42, Avery Rozar wrote: 

> Hello,
> I'm looking for some help understanding the SMTP preprocessor. For
> example. the attached pcap is from a hit on "smtp: Attempted data
> header buffer overflow, sid: 2; gid: 124". Digging in the PCAP the
> only thing (other than this looks like junk email) I can come up with
> is the "List" command to unsubscribe looks like it's longer than the
> 512 specified in the "max_command_line_len" parameter. Am I correct in
> this finding, or way off?
>
> Here is the preprocessor.rules:
>
> alert ( msg: "SMTP_DATA_HDR_OVERFLOW"; sid: 2; gid: 124; rev: 1;
> metadata: rule-type preproc, service smtp, policy security-ips drop ;
> classtype:attempted-admin; reference:cve,2002-1337;
> reference:cve,2010-4344; )
>
> Here is the Snort config file:
>
> # SMTP normalization and anomaly detection.  For more information, see
> README.SMTP
> preprocessor smtp: ports { 25 465 587 691 } \
> inspection_type stateful \
> b64_decode_depth 0 \
> qp_decode_depth 0 \
> bitenc_decode_depth 0 \
> uu_decode_depth 0 \
> log_mailfrom \
> log_rcptto \
> log_filename \
> log_email_hdrs \
> normalize cmds \
> normalize_cmds { ATRN AUTH BDAT CHUNKING DATA DEBUG EHLO EMAL ESAM
> ESND ESOM ETRN EVFY } \
> normalize_cmds { EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT
> RCPT RSET SAML SEND SOML } \
> normalize_cmds { STARTTLS TICK TIME TURN TURNME VERB VRFY X-ADAT
> X-DRCP X-ERCP X-EXCH50 } \
> normalize_cmds { X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN
> XLICENSE XQUE XSTA XTRN XUSR } \
> max_command_line_len 512 \
> max_header_line_len 1000 \
> max_response_line_len 512 \
> alt_max_command_line_len 260 { MAIL } \
> alt_max_command_line_len 300 { RCPT } \
> alt_max_command_line_len 500 { HELP HELO ETRN EHLO } \
> alt_max_command_line_len 255 { EXPN VRFY ATRN SIZE BDAT DEBUG EMAL
> ESAM ESND ESOM EVFY IDENT NOOP RSET } \
> alt_max_command_line_len 246 { SEND SAML SOML AUTH TURN ETRN DATA
> RSET QUIT ONEX QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE
> XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \
> valid_cmds { ATRN AUTH BDAT CHUNKING DATA DEBUG EHLO EMAL ESAM
> ESND ESOM ETRN EVFY } \
> valid_cmds { EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT
> RSET SAML SEND SOML } \
> valid_cmds { STARTTLS TICK TIME TURN TURNME VERB VRFY X-ADAT
> X-DRCP X-ERCP X-EXCH50 } \
> valid_cmds { X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN
> XLICENSE XQUE XSTA XTRN XUSR } \
> xlink2state { enabled }
>
> ------------------------------------------------------------------------------
> Go from Idea to Many App Stores Faster with Intel(R) XDK
> Give your users amazing mobile app experiences with Intel(R) XDK.
> Use one codebase in this all-in-one HTML5 development environment.
> Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
> http://pubads.g.doubleclick.net/gampad/clk?id=254741551&iu=/4140
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Go from Idea to Many App Stores Faster with Intel(R) XDK
Give your users amazing mobile app experiences with Intel(R) XDK.
Use one codebase in this all-in-one HTML5 development environment.
Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
http://pubads.g.doubleclick.net/gampad/clk?id=254741551&iu=/4140

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!