[Snort-sigs] SHELLCODE x86 NOOP (NOP Sled) Sid: 648
david.schedler at ...3286...
Mon Jan 8 12:38:52 EST 2007
Rule: SHELLCODE x86 NOOP (NOP Sled)
Summary: When I use MS Enterprise Manager from inside my network to
connect to a remote DB outside of my network (via internet) SNORT
attempts to block the remote DB's IP address.
Impact: Other web services, servers, and programs attempting to access
the DB at the same IP address are blocked from accessing the DB.
Detailed Information: We used Snort all weekend, with IIS servers having
no problem accessing a remote DB. When I arrived at work at 7:30 AM and
started Enterprise Manager the IP address to the DB was blocked.
Ease of Attack:
False Positives: Using Enterprise Manager creates NOPs
Corrective Action: Added the DB's IP address to white list. The DB is
the only resource at that IP address.
Trinity Real Estate Solutions, Inc.
Privileged or confidential information may be contained in this message.
If you have received it in error, you may not forward, copy or deliver
this message to anyone or disclose its contents to any other person. If
you are not the intended recipient, please destroy this message and
kindly notify the sender by reply email. Thank you for your cooperation
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-sigs