[Snort-sigs] False positive: MISC MS Terminal Server no encryption session initiation attempt (SID 2418)

Stephan Scholz sscholz at ...2481...
Wed Feb 7 09:39:08 EST 2007


I'd like to report a false positive concerning Windows Remote Desktop.



Rule:  MISC MS Terminal Server no encryption session initiation attempt

--
Sid: 2418

--
Summary:

--
Impact:

--
Detailed Information:

--
Affected Systems:

--
Attack Scenarios:

--
Ease of Attack:

--
False Positives:
Update Windows XP SP2 client with optional update: "Remote Desktop Connection (Terminal Services Client 6.0) for Windows XP (KB925876)"
Connect to an RDP server. This will lead to a false positive.

--
False Negatives:

--
Corrective Action:

--
Contributors:

-- 
Additional References:






More information about the Snort-sigs mailing list