Actions
Bug #200
closedsmb/dcerpc attack traffic not parsed properly
Affected Versions:
Effort:
Difficulty:
Label:
Description
The attached pcap contains traffic generated by metasploit for ms08-067. In wireshark we can see that there is quite a bit of DCERPC traffic present, but our SMB parser never invokes the DCERPC parser.
Files
Updated by Kirby Kuehl about 14 years ago
- File 0001-properly-handle-bytecount-of-0.patch 0001-properly-handle-bytecount-of-0.patch added
- % Done changed from 0 to 90
Properly handle ByteCount of 0.
Updated by Will Metcalf about 14 years ago
seems that we still don't alert on sid 7209 as we should given the pcap.
Updated by Kirby Kuehl about 14 years ago
The patch correctly addresses the problem where the smb parser was not correctly invoking the DCERPC parser, so I believe that this ticket should be closed. The problem with the alert not firing is probably closely related to the bug reported in Bug #206. I will look into that next.
Updated by Victor Julien about 14 years ago
- Status changed from Assigned to Closed
- % Done changed from 90 to 100
Patch applied, thanks Kirby.
Actions