Re: [Prelude Hybrid IDS] #143: prelude-manager overstepping varchar(255) field

Prelude Hybrid IDS <[email protected]>
Newsgroups gmane.comp.security.ids.prelude.devel
Message-ID <[email protected]> 
#143: prelude-manager overstepping varchar(255) field
-----------------------------------------------------+----------------------
 Reporter:  [email protected]                   |        Owner:  yoann             
     Type:  defect                                   |       Status:  assigned          
 Priority:  normal                                   |    Milestone:  LibpreludeDB 0.9.8
Component:  libpreludedb                             |      Version:  0.9               
 Severity:  major                                    |   Resolution:                    
 Keywords:  varchar varying overstepping postgresql  |  
-----------------------------------------------------+----------------------
Comment (by eric):

 I had the chance to try this again on a new system. here's some
 information:

 This is a sample of the errors from the log file (note how they're not all
 the same):

 May 29 08:00:02 locsrc@globemaster prelude-manager: could not insert
 message into database: Query error: ERROR:  value too long for type
 character varying(255) .
 May 30 08:00:02 locsrc@globemaster prelude-manager: could not insert
 message into database: Query error: ERROR:  value too long for type
 character varying(255) .
 May 31 08:00:02 locsrc@globemaster prelude-manager: could not insert
 message into database: Query error: ERROR:  value too long for type
 character varying(255) .
 May 31 15:10:52 locsrc@globemaster prelude-manager: could not insert
 message into database: Query error: ERROR:  value too long for type
 character varying(8) .
 May 31 15:10:52 locsrc@globemaster prelude-manager: could not insert
 message into database: Query error: ERROR:  value too long for type
 character varying(8) .
 May 31 16:09:25 locsrc@globemaster prelude-manager: could not insert
 message into database: ERROR:  value too long for type character
 varying(8).
 May 31 16:12:38 locsrc@globemaster prelude-manager: could not insert
 message into database: ERROR:  value too long for type character
 varying(8).
 May 31 16:28:47 locsrc@globemaster prelude-manager: could not insert
 message into database: ERROR:  invalid input syntax for type bytea.
 May 31 16:28:47 locsrc@globemaster prelude-manager: could not insert
 message into database: ERROR:  invalid input syntax for type bytea.


 It's hard to get you good output from manager-query.log since in the 2 or
 3 minutes that I ran it, the log file grew to 115MB!  Since there were
 thousands of logs for bytea errors, the following output is likely related
 to those (sensitive stuff carefully changed to keep character lengths):

 0.000s BEGIN
 0.000s INSERT INTO Prelude_Alert (messageid) VALUES('79909015648438')
 0.000s SELECT max(_ident) FROM Prelude_Alert;
 0.000s INSERT INTO Prelude_CreateTime (_parent_type, _message_ident, time,
 gmtoff, usec) VALUES('A', 22101, '2006-05-31 20:22:17', -14400, 709782)
 0.000s INSERT INTO Prelude_DetectTime (_message_ident, time, gmtoff, usec)
 VALUES(22101, '2006-05-31 20:13:26', -14400, 0)
 0.000s INSERT INTO Prelude_AnalyzerTime (_parent_type, _message_ident,
 time, gmtoff, usec) VALUES('A', 22101, '2006-05-31 20:22:17', -14400,
 740981)
 0.000s INSERT INTO Prelude_Assessment (_message_ident) VALUES(22101)
 0.000s INSERT INTO Prelude_Impact (_message_ident, severity, completion,
 type, description) VALUES(22101, 'low', 'succeeded', 'user', 'ABCDEF
 logged off')
 0.000s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident, _index,
 analyzerid, name, manufacturer, model, version, class, ostype, osversion)
 VALUES('A', 22101, 0, '4004684483993713', 'prelude-manager', 'http://www
 .prelude-ids.com', 'Prelude Manager', '0.9.3', 'Concentrator', 'Linux',
 '2.6.14-hardened-r5')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('A', 22101, 0, NULL,
 'prelude-manager', 31628, '/usr/bin/prelude-manager')
 0.000s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident, _index,
 analyzerid, name, manufacturer, model, version, class, ostype, osversion)
 VALUES('A', 22101, 1, '3612974876905030', 'prelude-lml', 'http://www
 .prelude-ids.com', 'Prelude LML', '0.9.2', 'Log Analyzer', 'Linux',
 '2.6.14-hardened-r5')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('A', 22101, 1, NULL,
 'prelude-lml', 14358, '/usr/bin/prelude-lml')
 0.000s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident, _index,
 analyzerid, name, manufacturer, model, version, class, ostype, osversion)
 VALUES('A', 22101, 2, NULL, 'NTsyslog', 'ntsyslog.sourceforge.net', NULL,
 NULL, 'Logging', NULL, NULL)
 0.000s INSERT INTO Prelude_Node (_parent_type, _message_ident,
 _parent0_index, ident, category, location, name) VALUES('A', 22101, 2,
 NULL, 'unknown', NULL, 'abcdef/abcdef')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('A', 22101, 2, NULL,
 'security[success]', NULL, NULL)
 0.000s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident, _index,
 analyzerid, name, manufacturer, model, version, class, ostype, osversion)
 VALUES('A', 22101, -1, NULL, 'NTsyslog', 'ntsyslog.sourceforge.net', NULL,
 NULL, 'Logging', NULL, NULL)
 0.000s INSERT INTO Prelude_Node (_parent_type, _message_ident,
 _parent0_index, ident, category, location, name) VALUES('A', 22101, -1,
 NULL, 'unknown', NULL, 'abcdef/abcdef')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('A', 22101, -1, NULL,
 'security[success]', NULL, NULL)
 0.000s INSERT INTO Prelude_Source (_message_ident, _index, ident, spoofed,
 interface) VALUES(22101, 0, NULL, 'unknown', NULL)
 0.000s INSERT INTO Prelude_User (_parent_type, _message_ident,
 _parent0_index, ident, category) VALUES('S', 22101, 0, NULL, 'os-device')
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22101, 0, 0, 0, 0, NULL, 'current-user',
 'DOMAINE\\ABCDEF$ ', NULL, NULL)
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22101, 0, 0, 0, 1, NULL, 'current-user',
 'ABCDEF', NULL, NULL)
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22101, 0, 0, 0, -1, NULL, 'current-user',
 'ABCDEF', NULL, NULL)
 0.000s INSERT INTO Prelude_Source (_message_ident, _index, ident, spoofed,
 interface) VALUES(22101, -1, NULL, 'unknown', NULL)
 0.000s INSERT INTO Prelude_User (_parent_type, _message_ident,
 _parent0_index, ident, category) VALUES('S', 22101, -1, NULL, 'os-device')
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22101, -1, 0, 0, 0, NULL, 'current-user',
 'DOMAINE\\ABCDEF$ ', NULL, NULL)
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22101, -1, 0, 0, 1, NULL, 'current-user',
 'ABCDEF', NULL, NULL)
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22101, -1, 0, 0, -1, NULL, 'current-user',
 'ABCDEF', NULL, NULL)
 0.000s INSERT INTO Prelude_Target (_message_ident, _index, ident, decoy,
 interface) VALUES(22101, 0, NULL, 'unknown', NULL)
 0.000s INSERT INTO Prelude_Node (_parent_type, _message_ident,
 _parent0_index, ident, category, location, name) VALUES('T', 22101, 0,
 NULL, 'unknown', NULL, 'abcdef/abcdef')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('T', 22101, 0, NULL,
 'security[success]', NULL, NULL)
 0.000s INSERT INTO Prelude_Target (_message_ident, _index, ident, decoy,
 interface) VALUES(22101, -1, NULL, 'unknown', NULL)
 0.000s INSERT INTO Prelude_Node (_parent_type, _message_ident,
 _parent0_index, ident, category, location, name) VALUES('T', 22101, -1,
 NULL, 'unknown', NULL, 'abcdef/abcdef')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('T', 22101, -1, NULL,
 'security[success]', NULL, NULL)
 0.000s INSERT INTO Prelude_Classification (_message_ident, ident, text)
 VALUES(22101, NULL, 'Logoff')
 0.000s INSERT INTO Prelude_AdditionalData (_parent_type, _message_ident,
 _index, type, meaning, data) VALUES('A', 22101, 0, 'string', 'Log received
 from', '/var/log/lan.snare')
 0.000s INSERT INTO Prelude_AdditionalData (_parent_type, _message_ident,
 _index, type, meaning, data) VALUES('A', 22101, 1, 'string', 'Original
 Log', 'May 31 16:13:26 abcdef/abcdef security[success] 538
 DOMAINE\\ABCDEF$  User Logoff:  User Name:ABCDEF$  Domain:DOMAINE  Logon
 ID:(0x0,0xF9022B)  Logon Type:3  ')
 0.000s ROLLBACK
 0.000s BEGIN
 0.000s INSERT INTO Prelude_Alert (messageid) VALUES('79913310615734')
 0.000s SELECT max(_ident) FROM Prelude_Alert;
 0.000s INSERT INTO Prelude_CreateTime (_parent_type, _message_ident, time,
 gmtoff, usec) VALUES('A', 22102, '2006-05-31 20:22:17', -14400, 711345)
 0.000s INSERT INTO Prelude_DetectTime (_message_ident, time, gmtoff, usec)
 VALUES(22102, '2006-05-31 20:13:27', -14400, 0)
 0.000s INSERT INTO Prelude_AnalyzerTime (_parent_type, _message_ident,
 time, gmtoff, usec) VALUES('A', 22102, '2006-05-31 20:22:17', -14400,
 741102)
 0.000s INSERT INTO Prelude_Assessment (_message_ident) VALUES(22102)
 0.000s INSERT INTO Prelude_Impact (_message_ident, severity, completion,
 type, description) VALUES(22102, 'low', 'succeeded', 'user',
 'Administrator  Domain logged off')
 0.000s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident, _index,
 analyzerid, name, manufacturer, model, version, class, ostype, osversion)
 VALUES('A', 22102, 0, '4004684483993713', 'prelude-manager', 'http://www
 .prelude-ids.com', 'Prelude Manager', '0.9.3', 'Concentrator', 'Linux',
 '2.6.14-hardened-r5')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('A', 22102, 0, NULL,
 'prelude-manager', 31628, '/usr/bin/prelude-manager')
 0.000s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident, _index,
 analyzerid, name, manufacturer, model, version, class, ostype, osversion)
 VALUES('A', 22102, 1, '3612974876905030', 'prelude-lml', 'http://www
 .prelude-ids.com', 'Prelude LML', '0.9.2', 'Log Analyzer', 'Linux',
 '2.6.14-hardened-r5')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('A', 22102, 1, NULL,
 'prelude-lml', 14358, '/usr/bin/prelude-lml')
 0.000s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident, _index,
 analyzerid, name, manufacturer, model, version, class, ostype, osversion)
 VALUES('A', 22102, 2, NULL, 'NTsyslog', 'ntsyslog.sourceforge.net', NULL,
 NULL, 'Logging', NULL, NULL)
 0.000s INSERT INTO Prelude_Node (_parent_type, _message_ident,
 _parent0_index, ident, category, location, name) VALUES('A', 22102, 2,
 NULL, 'unknown', NULL, 'abcdef/abcdef')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('A', 22102, 2, NULL,
 'security[success]', NULL, NULL)
 0.000s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident, _index,
 analyzerid, name, manufacturer, model, version, class, ostype, osversion)
 VALUES('A', 22102, -1, NULL, 'NTsyslog', 'ntsyslog.sourceforge.net', NULL,
 NULL, 'Logging', NULL, NULL)
 0.000s INSERT INTO Prelude_Node (_parent_type, _message_ident,
 _parent0_index, ident, category, location, name) VALUES('A', 22102, -1,
 NULL, 'unknown', NULL, 'abcdef/abcdef')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('A', 22102, -1, NULL,
 'security[success]', NULL, NULL)
 0.000s INSERT INTO Prelude_Source (_message_ident, _index, ident, spoofed,
 interface) VALUES(22102, 0, NULL, 'unknown', NULL)
 0.000s INSERT INTO Prelude_User (_parent_type, _message_ident,
 _parent0_index, ident, category) VALUES('S', 22102, 0, NULL, 'os-device')
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22102, 0, 0, 0, 0, NULL, 'current-user',
 'DOMAINE\\Administrator ', NULL, NULL)
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22102, 0, 0, 0, 1, NULL, 'current-user',
 'Administrator  Domain', NULL, NULL)
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22102, 0, 0, 0, -1, NULL, 'current-user',
 'Administrator  Domain', NULL, NULL)
 0.000s INSERT INTO Prelude_Source (_message_ident, _index, ident, spoofed,
 interface) VALUES(22102, -1, NULL, 'unknown', NULL)
 0.000s INSERT INTO Prelude_User (_parent_type, _message_ident,
 _parent0_index, ident, category) VALUES('S', 22102, -1, NULL, 'os-device')
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22102, -1, 0, 0, 0, NULL, 'current-user',
 'DOMAINE\\Administrator ', NULL, NULL)
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22102, -1, 0, 0, 1, NULL, 'current-user',
 'Administrator  Domain', NULL, NULL)
 0.000s INSERT INTO Prelude_UserId (_parent_type, _message_ident,
 _parent0_index, _parent1_index, _parent2_index, _index, ident, type, name,
 number, tty) VALUES('S', 22102, -1, 0, 0, -1, NULL, 'current-user',
 'Administrator  Domain', NULL, NULL)
 0.000s INSERT INTO Prelude_Target (_message_ident, _index, ident, decoy,
 interface) VALUES(22102, 0, NULL, 'unknown', NULL)
 0.000s INSERT INTO Prelude_Node (_parent_type, _message_ident,
 _parent0_index, ident, category, location, name) VALUES('T', 22102, 0,
 NULL, 'unknown', NULL, 'abcdef/abcdef')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('T', 22102, 0, NULL,
 'security[success]', NULL, NULL)
 0.000s INSERT INTO Prelude_Target (_message_ident, _index, ident, decoy,
 interface) VALUES(22102, -1, NULL, 'unknown', NULL)
 0.000s INSERT INTO Prelude_Node (_parent_type, _message_ident,
 _parent0_index, ident, category, location, name) VALUES('T', 22102, -1,
 NULL, 'unknown', NULL, 'abcdef/abcdef')
 0.000s INSERT INTO Prelude_Process (_parent_type, _message_ident,
 _parent0_index, ident, name, pid, path) VALUES('T', 22102, -1, NULL,
 'security[success]', NULL, NULL)
 0.000s INSERT INTO Prelude_Classification (_message_ident, ident, text)
 VALUES(22102, NULL, 'Logoff')
 0.000s INSERT INTO Prelude_AdditionalData (_parent_type, _message_ident,
 _index, type, meaning, data) VALUES('A', 22102, 0, 'string', 'Log received
 from', '/var/log/lan.snare')
 0.000s INSERT INTO Prelude_AdditionalData (_parent_type, _message_ident,
 _index, type, meaning, data) VALUES('A', 22102, 1, 'string', 'Original
 Log', 'May 31 16:13:27 abcdef/abcdef security[success] 538
 DOMAINE\\Administrator  User Logoff:  User Name:Administrator
 Domain:DOMAINE  Logon ID:(0x0,0xF90497)  Logon Type:3  ')
 0.000s ROLLBACK

 I can't tell what logs are causing these right now... perhaps it was this:

 May 31 16:28:42 abcdef/abcdef security[success] 538 DOMAINE\Administrator
 User Logoff:  User Name:Administrator  Domain:DOMAINE  Logon
 ID:(0x0,0xFEEF9D)  Logon Type:3

 Let me know if you need any more info.

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/143>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.