Project

General

Profile

Actions

Bug #3780

closed

Negated content with distance FP

Added by Francis Trudeau over 2 years ago. Updated 2 months ago.

Status:
Rejected
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

The following signature:

alert udp any any -> any any (msg:"Negated content with distance test"; content:"|C0 0C 00 10 00 01|"; content:!"v=spf"; distance:0; sid:30303; rev:1;)

This rule alerts on the attached pcap. The attached pcap has 'v=spf' in the packet after the hex content in the signature.

Tested with 6.0.0-dev (e5fd47dcf 2020-05-01), 5.0.3, 4.1.8, 4.0.7.


Files

negated_content_distance.pcap (708 Bytes) negated_content_distance.pcap Francis Trudeau, 06/24/2020 05:12 PM
clipboard-202211162139-zscym.png (315 KB) clipboard-202211162139-zscym.png Victor Julien, 11/16/2022 08:39 PM

Subtasks 2 (0 open2 closed)

Task #5482: create SV tests to demonstrate false positive behavior for negated content and distance (bug 3780)ClosedShivani BhardwajActions
Bug #5605: Negated content with distance FP (6.0.x backport)RejectedActions
Actions #1

Updated by Victor Julien 6 months ago

  • Status changed from New to Assigned
  • Assignee set to Victor Julien
  • Priority changed from Normal to High
  • Target version set to 7.0.0-beta1
  • Label Needs backport to 6.0 added
Actions #2

Updated by Juliana Fajardini Reichow 6 months ago

  • Related to Task #5482: create SV tests to demonstrate false positive behavior for negated content and distance (bug 3780) added
Actions #3

Updated by Victor Julien 6 months ago

  • Subtask #5482 added
Actions #4

Updated by Shivani Bhardwaj 3 months ago

  • Subtask #5605 added
Actions #5

Updated by Shivani Bhardwaj 3 months ago

  • Label deleted (Needs backport to 6.0)
Actions #6

Updated by Victor Julien 3 months ago

  • Target version changed from 7.0.0-beta1 to 7.0.0-rc1
Actions #7

Updated by Victor Julien 3 months ago

I believe that the behavior is correct. content:"|C0 0C 00 10 00 01|"; is found 4 times in the payload. Three of them before the v=spf string, 1 after. The one after then looks if it is followed by v=spf, which it isn't. So the content:!"v=spf"; distance:0; matches that 4th time, as expected.

Actions #8

Updated by Victor Julien 3 months ago

  • Status changed from Assigned to Rejected
Actions

Also available in: Atom PDF