504.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule:  

--
Sid:
504

--
Summary:
This event is generated when possible non-legitimate traffic is detected
that should not be allowed through a firewall.

--
Impact:
This can be used to pass through a poorly configured firewall.

--
Detailed Information:

Traffic from TCP port 53 is used by DNS servers for zone transfers.  
Normal DNS traffic uses the UDP protocol.  An attacker could use a TCP 
source port of 53 to pass through a poorly configured firewall.  DNS 
traffic from port 53 using either UDP or TCP should be to a port above 
1023.  Ports 1023 and below are privileged.

--
Affected Systems:

All

--
Attack Scenarios:
An attacker could use a source port of 53 for TCP connections to bypass 
a poorly configured firewall.  

--
Ease of Attack:
Simple.

--
False Positives:
None known.

--
False Negatives:
None known.

--
Corrective Action:
Incoming connections from TCP port 53 should only be allowed to machines
that need the ability to do zone tranfers.  

Connections from TCP port 53 should only be allowed to ports >=1024 on 
these machines.  

--
Contributors:
Original Rule Writer Unknown
Sourcefire Research Team
Nigel Houghton <[e-mail]>
Snort documentation contributed by Steven Alexander<[e-mail]>
-- 
Additional References:

Arachnids:
http://www.whitehats.com/info/IDS07

--