[Snort-sigs] SHELLCODE x86 NOOP (NOP Sled) Sid: 648

David Schedler david.schedler at ...3286...
Mon Jan 8 12:38:52 EST 2007


Rule:  SHELLCODE x86 NOOP (NOP Sled)
 
--
Sid: 648
 
--
Summary: When I use MS Enterprise Manager from inside my network to
connect to a remote DB outside of my network (via internet) SNORT
attempts to block the remote DB's IP address.
 
--
Impact: Other web services, servers, and programs attempting to access
the DB at the same IP address are blocked from accessing the DB.
 
--
Detailed Information: We used Snort all weekend, with IIS servers having
no problem accessing a remote DB.  When I arrived at work at 7:30 AM and
started Enterprise Manager the IP address to the DB was blocked.
 
--
Affected Systems:
 
--
Attack Scenarios:
 
--
Ease of Attack:
 
--
False Positives:  Using Enterprise Manager creates NOPs
 
--
False Negatives:
 
--
Corrective Action: Added the DB's IP address to white list.  The DB is
the only resource at that IP address.
 
--
Contributors:
 
-- 
Additional References:

 

 

David Schedler

Trinity Real Estate Solutions, Inc.

972-865-0215

972-865-0219 (fax)

www.TrinityInspection.com

 

Privileged or confidential information may be contained in this message.
If you have received it in error, you may not forward, copy or deliver
this message to anyone or disclose its contents to any other person.  If
you are not the intended recipient, please destroy this message and
kindly notify the sender by reply email. Thank you for your cooperation

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20070108/38ad5b76/attachment.html>


More information about the Snort-sigs mailing list