flowbits: netsenum

[waldo kitty <wkitty42 () windstream net>]

there is no check rule in the *.rules files for flowbits: netsenum...

additionally, both existing rules' MSG are identical... one should speak of "to 
client" and the other "to server" in the MSG for clarity??


registered subscriber using latest rules pulled 26 May 2013 for

    ,,_     -*> Snort! <*-
   o"  )~   Version 2.9.4.1 GRE (Build 69)
    ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
            Copyright (C) 1998-2013 Sourcefire, Inc., et al.
            Using libpcap version 1.1.1
            Using PCRE version: 7.8 2008-09-05
            Using ZLIB version: 1.2.6



May 26 04:25:44 frodo snort[22314]: WARNING: flowbits key 'netsenum' is set but 
not ever checked.


$ grep -E "netsenum" /path/to/snort/*rules*/*.rules

/path/to/snort/rules/os-windows.rules:#alert tcp any [137,139] -> $HOME_NET any 
(msg:"OS-WINDOWS SMB Microsoft Windows RAP API NetServerEnum2 long server name 
buffer overflow attempt"; flow:to_client,established; flowbits:isset,netsenum; 
content:"|EA 00|"; depth:2; offset:60; isdataat:22; content:!"|00|"; within:16; 
distance:6; metadata:policy security-ips drop, service netbios-ssn; 
reference:bugtraq,54940; reference:cve,2012-1853; 
reference:url,osvdb.org/show/osvdb/84601; 
reference:url,technet.microsoft.com/en-us/security/bulletin/MS12-054; 
classtype:attempted-dos; sid:24007; rev:4;)

/path/to/snort/rules/os-windows.rules:alert tcp $HOME_NET any -> any [137,139] 
(msg:"OS-WINDOWS SMB Microsoft Windows RAP API NetServerEnum2 long server name 
buffer overflow attempt"; flow:to_server,established; content:"|68 00|WrLehD"; 
pcre:"/^[oz]/Ri"; content:"|01 00|"; within:2; distance:9; 
flowbits:set,netsenum; flowbits:noalert; metadata:service netbios-ssn; 
reference:bugtraq,54940; reference:cve,2012-1853; 
reference:url,osvdb.org/show/osvdb/84601; 
reference:url,technet.microsoft.com/en-us/security/bulletin/MS12-054; 
classtype:attempted-dos; sid:23839; rev:8;)

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!