This is a new custom signature entry for the recent SysV /bin/login Buffer Overflow referenced in CERT Advisory CA-2001-34. This signature is provided as a supplement to S13 signatures 3403 and 3501 to better detect any attacks. It will be incorporated into a future signature update. Listed below is a sample screenshot of the output of the SigWizMenu tool. Please refer to the sensor Release Notes for instructions on how to use the SigWizMenu tool to add a custom signature.
Tune Signature Parameters : CSIDS Signature Wizard
___________________________________________________________________________
Current Signature: Engine STRING.TCP SIGID 20000
SigName: SysV /bin/login Overflow
___________________________________________________________________________
0 - Edit ALL Parameters
1 - AlarmInterval =
2 - AlarmThrottle = FireOnce
3 - ChokeThreshold =
4 - Direction = ToService
5 - FlipAddr =
6 - MaxInspectLength =
7 - MinHits = 1
8 - MinMatchLength =
9 - MultipleHits =
10 * RegexString = ([ \t][^ =\r\n]*[=][^ =\r\n][\x00-x7F]*){5}[\x00-\xff]*[\x80-\xff]
11 - ResetAfterIdle = 15
12 - ServicePorts = 23,513
13 - SigComment =
14 - SigName = SysV /bin/login Overflow
15 - SigStringInfo = /bin/login x1=1 x2=2...
16 - StripTelnetOptions = TRUE
17 - ThrottleInterval =
18 - WantFrag =
d - Delete a value
u - UNDO and continue
x - SAVE and continue
___________________________________________________________________________
