Project

General

Profile

Actions
Copy link

Bug #227

closed
RR AS

strange FP on suricata v101/100

Bug #227: strange FP on suricata v101/100

Added by rmkml rmkml over 15 years ago. Updated over 15 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Anoop Saldanha
Target version:
1.1beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

Hi,
I have a strange FP with theses two sigs:
alert tcp any 80 -> any any (msg:"http reply 1"; flow:to_client,established; content:"HTTP/1."; nocase; depth:7; content:!" 200 OK"; nocase; distance:1; content:!" 206 Partial Content"; nocase; distance:1; classtype:attempted-admin; sid:9014691; rev:1; )
alert tcp any 80 -> any any (msg:"http reply 2"; flow:to_client,established; content:"HTTP/1."; content:" Expect"; nocase; within:20; distance:0; classtype:misc-attack; sid:9014252; rev:1;)
suricata v101/100 generate two alerts:
07/30/10-16:06:26.005780 [**] [1:9014691:1] http reply 1 [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 3] {6} 66.249.92.104:80 -> 192.168.70.5:56913
07/30/10-16:10:26.004807 [**] [1:9014691:1] http reply 1 [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 3] {6} 66.249.92.104:80 -> 192.168.70.5:56913
but if you disable second sig/sid (9014252), only one alert fire.
Why second alert not fire if I disable second sig/sid please?
Regards
Rmkml

Files

Download all files
Surf_Jacking_httpswillnotsaveyou.pdf (249 KB) Surf_Jacking_httpswillnotsaveyou.pdf rmkml rmkml, 08/06/2010 06:08 AM
0001-fix-for-bug-227.-For-negated-contents-that-have-been.patch (1.53 KB) 0001-fix-for-bug-227.-For-negated-contents-that-have-been.patch Anoop Saldanha, 10/28/2010 12:03 AM

WM Updated by Will Metcalf over 15 years ago Actions
Copy link
 #1

  • Due date set to 08/20/2010
  • Assignee set to OISF Dev
  • Target version set to 1.0.2
  • Estimated time set to 2.50 h

Confirmed and, Bizarre indeed. The second alert comes from packet #63 in the pcap the rmkml provided to me which doesn't have HTTP server response in it whatsoever. It is part of the same tcp stream as the alert that should fire in packet #69. Please contact me for a copy of the pcap.

VJ Updated by Victor Julien over 15 years ago Actions
Copy link
 #2

  • Target version changed from 1.0.2 to 1.1beta1

AS Updated by Anoop Saldanha over 15 years ago Actions
Copy link
 #3

  • Assignee changed from OISF Dev to Anoop Saldanha

AS Updated by Anoop Saldanha over 15 years ago Actions
Copy link
 #4

Attached a patch. We should see 2 alerts now irrespective of sid #2's presence.

VJ Updated by Victor Julien over 15 years ago Actions
Copy link
 #5

  • Status changed from New to Closed
  • % Done changed from 0 to 100

Applied to my local tree. Thanks Anoop!

Actions
Copy link

Also available in: PDF Atom