full-disclosure - "Alert mangling" in Snort version >= 2.0.6 and

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1077017783.505.38.camel@bobby.exaprobe.com>
From: nicob at nicob.net (Nicob)
Subject: "Alert mangling" in Snort version >= 2.0.6 and < 2.1.1-RC1

Not really a vulnerability, but "alert mangling" could be a serious
problem if the analysts (or the correlation engine) mainly use the
classification made by Snort rather than the packet payload :

"Signature mangling fixes"
http://cvs.sourceforge.net/viewcvs.py/snort/snort/RELEASE.NOTES?rev=1.3

"There is a known bug since Snort 2.0.6 where the wrong label gets
attached to alerts.  It's been fixed in the CVS and will be released as
version 2.1.1 (if it hasn't already)."
http://sourceforge.net/mailarchive/message.php?msg_id=7072376

I've seen many wrong classifications because of this bug. It's weird,
but the wrongly classified entries often get a "MS-SQL Worm propagation
attempt" name.

Example : a "open proxies" SYN scan
[**] [1:2003:2] MS-SQL Worm propagation attempt [**]
> 02/15-17:41:08.045761 A.B.C.D:4156 -> W.X.Y.Z:3128

-- 
Nicob <nicob@...ob.net>