115-4.txt

来自「This is the snapshot of Snot Latest Rule」· 文本 代码 · 共 70 行

Rule:

--
Sid:
115-4

--
Summary:
This event is generated when the pre-processor asn1 detects network
traffic that may constitute an attack. Specifically an asn.1 spec
violation, indicating a possible overflow attempt was detected.

--
Impact:
Unknown.

--
Detailed Information:
This event is generated when the asn1 pre-processor detects network
traffic that may consititute an attack.

This may indicate an attempt to overflow a fixed length buffer in an
application using the asn1 libraries.

More information on this event can be found in the individual
pre-processor documentation README.asn1 in the docs directory of the
snort source. Detailed instructions and examples on how to tune and use
the pre-processor can also be found in the same document.

--
Affected Systems:
	All.

--
Attack Scenarios:

--
Ease of Attack:
Simple.

--
False Positives:
None Known.

--
False Negatives:
None Known.

--
Corrective Action:
Check the target host for signs of compromise.

Apply any appropriate vendor supplied patches.

--
Contributors:
Sourcefire Vulnerability Research Team
Daniel Roelker <[e-mail]>
Nigel Houghton <[e-mail]>

--
Additional References:

ASN1 Information Site:
http://asn1.elibel.tm.fr/

--