Re: Zoom meeting causes many [SERVER-MSSQL probe response overflow attempt]
Joel Esler via Snort-sigs <[email protected]> Wed, 20 Dec 2023 13:51:33 -0500
| Newsgroups | gmane.comp.security.ids.snort.sigs |
|---|---|
| Message-ID | <[email protected]> |
Easy fix for this should be to set the sql_servers variable. Also if you aren’t running sql_servers, turn the rule off. This vulnerability is from 2003. If you’re running internet facing 20 year old software, you have more problems than capturing packets. — Sent from my iPhone On Dec 20, 2023, at 10:26, Al Lewis (allewi) via Snort-sigs <[email protected]> wrote: alert udp $EXTERNAL_NET any -> $SQL_SERVERS any (msg:"SERVER-MSSQL probe response overflow attempt"; flow:to_server; content:"|05|"; depth:1; byte_test:2,>,512,1; content:"|3B|"; distance:0; isdataat:512,relative; content:!"|3B|"; within:512; metadata:policy max-detect-ips drop, ruleset community; reference:bugtraq,9407; reference:cve,2003-0903; reference:nessus,11990; reference:url,technet.microsoft.com/en-us/security/bulletin/MS04-003; classtype:attempted-user; sid:2329; rev:15; gid:1; ) Thats the rule.. so you may need to set your variables correctly. Albert Lewis Email: [email protected] ---------- From: Al Lewis (allewi) <[email protected]> Sent: Wednesday, December 20, 2023 10:03 AM To: John <[email protected]> Cc: [email protected] <[email protected]> Subject: Re: [Snort-sigs] Zoom meeting causes many [SERVER-MSSQL probe response overflow attempt] That would grab all traffic from the host. You should be able to filter it down to only the traffic that is triggering the event. Then use that to replay back into snort and check your rules/configuration. The ports listed below aren't the defaults for MSSQL. Albert Lewis Email: [email protected] ---------- From: John <[email protected]> Sent: Tuesday, December 19, 2023 1:07 PM To: Al Lewis (allewi) <[email protected]> Cc: [email protected] <[email protected]> Subject: Re: [Snort-sigs] Zoom meeting causes many [SERVER-MSSQL probe response overflow attempt] I did not create a capture. It has been a long time since I used tcpdump. Is this the correct way to grab some traffic? Assuming the target IP is 10.9.5.106: tcpdump -i eth0 host 10.9.5.106 -w /tmp/capture On Tuesday, December 19th, 2023 at 12:23 PM, Al Lewis (allewi) <[email protected]> wrote: > Do you have a pcap of the traffic that you can share? > > > Albert Lewis > > Email: [email protected] > > From: Snort-sigs <[email protected]> on behalf of John via Snort-sigs <[email protected]> > Sent: Tuesday, December 19, 2023 7:57 AM > To: [email protected] <[email protected]> > Subject: [Snort-sigs] Zoom meeting causes many [SERVER-MSSQL probe response overflow attempt] > > When in a zoom meeting, snort is dropping hundreds of thousands packets which are getting flagged as: > > "SERVER-MSSQL probe response overflow attempt" [**] [Classification: Attempted User Privilege Gain] [Priority: 1] {UDP} 206.247.41.152:8801 -> 10.1.2.202:60966 > > Is this a false positive? > _______________________________________________ > Snort-sigs mailing list > [email protected] > https://lists.snort.org/mailman/listinfo/snort-sigs > > Please visit http://blog.snort.org for the latest news about Snort! > > Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette > > Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging emerging> threats</a>! _______________________________________________ Snort-sigs mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>! _______________________________________________ Snort-sigs mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!