topic Re: Mercantec Softcart Overflow in Network Security

Mercantec Softcart Overflow

HEATH FREEL — Sun, 10 Mar 2019 09:22:03 GMT

I have recently hooked up a 4240 and found a lot of internal traffic, producing this alarm. SIG ID 5307.

In looking at the packet data it seems to be ligitimate traffic - gmail and others.

The NSDB lists no benign triggers.

Does anyone have any other infomation of this signature? Should I just disable it?

Thanks,

Re: Mercantec Softcart Overflow

darin.marais — Sat, 02 Apr 2005 13:14:46 GMT

If my memory serves correct, I seem to remember that this signature was buggie in its initial release but has been rectified in one or other signature update.

what signature update is installed??

Re: Mercantec Softcart Overflow

darin.marais — Sat, 02 Apr 2005 13:39:28 GMT

I tried to search for the bug but did not find it so I could very well be wrong about it being bug prone I may have just confused it with something else, however the signature has been noted in one other thread on this forum.

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1dd69fe9

Re: Mercantec Softcart Overflow

craiwill — Sat, 02 Apr 2005 20:08:46 GMT

There are no known benign triggers for this signature. Signature 5307 is searching in the URI field for a request to /cgi-bin/softcart.exe with total request length over 500. The URI field in service.http is defined as anything from the GET to the next CRLF. This should prevent most false positives since the signature can only inspect http headers and looks for a large request to /cgi-bin/softcart.exe. If you could provide a traffic sample or captured packet from the suspected traffic it would be very helpful.

Thanks,

Craig

Re: Mercantec Softcart Overflow

HEATH FREEL — Mon, 04 Apr 2005 11:38:44 GMT

I have attached the captured packet from the details of the alarm.

Any help is appreciated.

Re: Mercantec Softcart Overflow

craiwill — Mon, 04 Apr 2005 12:58:28 GMT

I do not see anything in this capture that would fire the alarm. It is possible that the call to the softcart executable is too far away from the end of the request and did not make it into the context buffer. What may be happening is that a company legitimately uses enough arguments on their softcart server to trigger the alarm. If the server from the capture is not running a vulnerable version this would not overflow the server, but it would overflow an older server. Since we really have no way of telling the version of softcart a server is running we cannot check that in the signature. That being said, if you have any captures that include the call to the softcart executable I could tell for sure and may be able to improve our signature.

Thanks,

Craig

Re: Mercantec Softcart Overflow

scothrel — Fri, 15 Apr 2005 17:56:50 GMT

If this was on 5.0(1), you might try 5.0(2). There is a known issue if you tuned some regex based signatures they started to have false positives. The underlying issue was fixed in 5.0(2).