[Snort-sigs] BACKDOOR NetMetro File List Signature False Positive

Nigel Houghton nigel at ...435...
Fri Aug 27 08:13:01 EDT 2004

On  0, "McCash, John" <John.McCash at ...2471...> allegedly wrote:
> Here's a suggested update for the 'BACKDOOR NetMetro File List' signature, which lists a possible false positive that I've just observed.
> 		John McCash
> False Positives 	This rule can generate a false positive if a web request goes out on port 5032, and is responded to by a web server with a string containing '--'

Please check your $EXTERNAL_NET and $HOME_NET variables. This rule contains
a number of things that indicate your false positive condition does not

 1. $EXTERNAL_NET any -> $HOME_NET 5032 -- This means the direction of flow
 is from the outside to the inside and is destined for an inside
 destination port of 5032

 2. flow:to_server,established; -- This means the handshake is done from
 the outside to the inside and the session is set up (see 1)

 3. content:"--"; -- When sombined with 1 & 2, this means the "--" is in
 the stream from outside to inside.

Now, your false positive indicates that this rule would fire on a session
intiated from inside to an outside. Please make sure your variables are not
set to "any" in snort.conf and observe the rule some more. If you still
think you have false positives, send more details along with a packet
capture of the traffic causing the false positives.

       Nigel Houghton       Research Engineer        Sourcefire Inc.
                       Vulnerability Research Team
  "Dude, dolphins are intelligent and friendly!" - Wendy
  "Intelligent and friendly on rye bread, with some mayonaise." - Cartman

More information about the Snort-sigs mailing list