Project

General

Profile

Actions

Bug #227

closed

strange FP on suricata v101/100

Added by rmkml rmkml about 12 years ago. Updated almost 12 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Hi,
I have a strange FP with theses two sigs:
alert tcp any 80 -> any any (msg:"http reply 1"; flow:to_client,established; content:"HTTP/1."; nocase; depth:7; content:!" 200 OK"; nocase; distance:1; content:!" 206 Partial Content"; nocase; distance:1; classtype:attempted-admin; sid:9014691; rev:1; )
alert tcp any 80 -> any any (msg:"http reply 2"; flow:to_client,established; content:"HTTP/1."; content:" Expect"; nocase; within:20; distance:0; classtype:misc-attack; sid:9014252; rev:1;)
suricata v101/100 generate two alerts:
07/30/10-16:06:26.005780 [**] [1:9014691:1] http reply 1 [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 3] {6} 66.249.92.104:80 -> 192.168.70.5:56913
07/30/10-16:10:26.004807 [**] [1:9014691:1] http reply 1 [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 3] {6} 66.249.92.104:80 -> 192.168.70.5:56913
but if you disable second sig/sid (9014252), only one alert fire.
Why second alert not fire if I disable second sig/sid please?
Regards
Rmkml


Files

Actions #1

Updated by Will Metcalf about 12 years ago

  • Due date set to 08/20/2010
  • Assignee set to OISF Dev
  • Target version set to 1.0.2
  • Estimated time set to 2.50 h

Confirmed and, Bizarre indeed. The second alert comes from packet #63 in the pcap the rmkml provided to me which doesn't have HTTP server response in it whatsoever. It is part of the same tcp stream as the alert that should fire in packet #69. Please contact me for a copy of the pcap.

Actions #2

Updated by Victor Julien about 12 years ago

  • Target version changed from 1.0.2 to 1.1beta1
Actions #3

Updated by Anoop Saldanha almost 12 years ago

  • Assignee changed from OISF Dev to Anoop Saldanha
Actions #4

Updated by Anoop Saldanha almost 12 years ago

Attached a patch. We should see 2 alerts now irrespective of sid #2's presence.

Actions #5

Updated by Victor Julien almost 12 years ago

  • Status changed from New to Closed
  • % Done changed from 0 to 100

Applied to my local tree. Thanks Anoop!

Actions

Also available in: Atom PDF