topic Re: Windows RPC DCOM Overflow sub id 8 in Network Security

Windows RPC DCOM Overflow sub id 8

yuliang13 — Sun, 10 Mar 2019 11:28:10 GMT

hi,

lately i've been hammered badly by this signature. the funny thing is the destination ports are highports ,etc 1025,5000,etc (non netbios) . i noticed this signature has been firing frequently since ms08-067. anyone having the same experience ? is this a true positive?

thanks in advnce

Re: Windows RPC DCOM Overflow sub id 8

rupadras — Mon, 26 Jan 2009 22:21:58 GMT

If you are referring to sig 3327 subsig 8, it doesn't have any event-action associated with it by default. By any chance, have you tuned the sig or added an Event Action Override that might be applied to it?

Re: Windows RPC DCOM Overflow sub id 8

yuliang13 — Tue, 03 Feb 2009 02:06:32 GMT

hi,

yes, i'm referring to 3327. I do not think we have tuned it as we have hundreds of IPS deployed.Do you mind if i send you the payload to have a look?

Re: Windows RPC DCOM Overflow sub id 8

yuliang13 — Mon, 16 Feb 2009 06:53:03 GMT

if there are no event-action associated to it, does this means the signature is actually not important ?

Re: Windows RPC DCOM Overflow sub id 8

yuliang13 — Tue, 03 Mar 2009 10:12:45 GMT

cisco IPS seems very ineffective as an IPS

Re: Windows RPC DCOM Overflow sub id 8

mzeiser — Tue, 03 Mar 2009 11:14:06 GMT

Signature 3327-8 is a meta component and thus only part of a signature. It does not have any event actions by default as the main signature is the one that'll produce an alert once the required components have been triggered by an attack.

A component going off may not be of significance, which is why they are set not not produce alert by default. If you've changed this setting, and are now annoyed by the alerts, I suggest turning it back to default.

Martin Zeiser

IPS Signature Team

Re: Windows RPC DCOM Overflow sub id 8

yuliang13 — Tue, 03 Mar 2009 11:32:33 GMT

Hi martin,

thanks for the reply. I've tried RPC DCOM exploit over this signature. only the subsig 8 was triggered upon the exploit attempt. Do you think this signature is important ?

Re: Windows RPC DCOM Overflow sub id 8

mzeiser — Tue, 03 Mar 2009 12:04:14 GMT

This signature is relevant to cve-2003-0352, which is the vulnerability the Blaster worm abused. I'm sure there's still a bunch of old machines out there infected by this worm and scanning the Internet for victims.

Re: Windows RPC DCOM Overflow sub id 8

yuliang13 — Tue, 03 Mar 2009 15:46:43 GMT

hi,

yes it's related to that. i'm using the exploit for that vulnerability and it triggered signature 8 only. i think this means sub id 8 should be quite important right?