topic IDS Sig 4058 question in Network Security

IDS Sig 4058 question

g-pfeiffer — Sun, 10 Mar 2019 09:25:57 GMT

Sig 4058 subsig 1 (IDS Signature UPnP LOCATION Overflow) was triggered on one of our sensors as what appears to me to be a false positive. From what I understand, the sig fires on a payload of 116 characters or more to service port 5000 TCP. The destination port was tcp 5000 and the context of the alert triggered was:

http://64.4.18.250/cgi-bin/getmsg/IMG_0091.JPG?curmbox=F000000004&a=46c002caa67737093a99d6df1e381c77&msg=MSG1114736378.24&start=169086&len=7145246&mimepart=7&disk=64.4.18.31_d1261&login=m_dinino&domain=hotmail%2ecom&_lang=EN&count

Is it just a long payload to port 5000 that alerted this or is there something that I am missing?

Re: IDS Sig 4058 question

wsulym — Mon, 02 May 2005 01:14:11 GMT

Signature 4058.1 has hidden parameters and we can't disclose that information. As the signature description reads, 4058.1 triggers upon detecting a large location request sent to a UPnP device. This subsignature looks for requests to TCP port 5000.

However, I can say that what you have here from the context buffer would not have triggered the alarm by itself. There's something else in the stream that cause the alert to trigger - if you happen to have a pcap of the session, I'd be happy to take a look at it. If not, judging from the information you have here, this is most likely a false positive.