Project

General

Profile

Actions
Copy link

Bug #3780

closed
FT VJ

Negated content with distance FP

Bug #3780: Negated content with distance FP

Added by Francis Trudeau almost 6 years ago. Updated over 3 years ago.

Status:
Rejected
Priority:
Normal
Assignee:
Victor Julien
Target version:
7.0.0-rc1
Affected Versions:
4.1.8, 5.0.3, 6.0.0rc1
Effort:
Difficulty:
Label:

Description

The following signature:

alert udp any any -> any any (msg:"Negated content with distance test"; content:"|C0 0C 00 10 00 01|"; content:!"v=spf"; distance:0; sid:30303; rev:1;)

This rule alerts on the attached pcap. The attached pcap has 'v=spf' in the packet after the hex content in the signature.

Tested with 6.0.0-dev (e5fd47dcf 2020-05-01), 5.0.3, 4.1.8, 4.0.7.

Files

Download all files
negated_content_distance.pcap (708 Bytes) negated_content_distance.pcap Francis Trudeau, 06/24/2020 05:12 PM
clipboard-202211162139-zscym.png (315 KB) clipboard-202211162139-zscym.png Victor Julien, 11/16/2022 08:39 PM

Subtasks 2 (0 open — 2 closed)

Task #5482: create SV tests to demonstrate false positive behavior for negated content and distance (bug 3780)ClosedShivani BhardwajActions
Bug #5605: Negated content with distance FP (6.0.x backport)RejectedActions

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #1

  • Status changed from New to Assigned
  • Assignee set to Victor Julien
  • Priority changed from Normal to High
  • Target version set to 7.0.0-beta1
  • Label Needs backport to 6.0 added

JF Updated by Juliana Fajardini Reichow over 3 years ago Actions
Copy link
 #2

  • Related to Task #5482: create SV tests to demonstrate false positive behavior for negated content and distance (bug 3780) added

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #3

  • Subtask #5482 added

SB Updated by Shivani Bhardwaj over 3 years ago Actions
Copy link
 #4

  • Subtask #5605 added

SB Updated by Shivani Bhardwaj over 3 years ago Actions
Copy link
 #5

  • Label deleted (Needs backport to 6.0)

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #6

  • Target version changed from 7.0.0-beta1 to 7.0.0-rc1

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #7

I believe that the behavior is correct. content:"|C0 0C 00 10 00 01|"; is found 4 times in the payload. Three of them before the v=spf string, 1 after. The one after then looks if it is followed by v=spf, which it isn't. So the content:!"v=spf"; distance:0; matches that 4th time, as expected.

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #8

  • Status changed from Assigned to Rejected
Actions
Copy link

Also available in: PDF Atom