[Snort-users] SA login failed.....

Eric Hines eric.hines at ...8860...
Tue Mar 29 06:55:39 EST 2005


Jeff,
 
This is a response to the stimulus. It's your Mysql server running on that
system telling the remote host that their attempt to login as 'sa' failed --
which I'm sure as you know, is equivalent to the administrator account on
microsoft sql servers. The reason you'll see this so frequently is that the
default installation of MSSQL Server (can't remember which versions) install
the sa account with default no password.
 

Best Regards,


Eric Hines, GCIA, CISSP
CEO, President, Chairman
Applied Watch Technologies, LLC
1134 N. Main St.
Algonquin, IL 60102
Tel: (877) 262-7593 x327
Fax: (877) 262-7593
Web: http://www.appliedwatch.com
  

 

________________________________

From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Jeff Heckart
Sent: Tuesday, March 29, 2005 8:46 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] SA login failed.....



I am getting quite a few unusual alerts, and am confused with what I am
seeing.

 

The payload of the packet is:

04 01 00 3B 00 00 01 00 AA 27 00 18 48 00 00 01        ...;....*'..H...

0E 1B 00 4C 6F 67 69 6E 20 66 61 69 6C 65 64 20        ...Login failed 

66 6F 72 20 75 73 65 72 20 27 73 61 27 2E 00 00        for user 'sa'...

00 00 FD 02 00 00 00 00 00 00 00                       ..}........

 

The strange thing is that the source is:

x.x.x.x:1433 (our network)

Destination

x.x.x.x: 2838/random (remote unknown network)

 

This has now happened to two systems, both running mysql on tcp/1433.  It
just makes no sense that the source port is 1433.  What am I missing here?






More information about the Snort-users mailing list