cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
992
Views
0
Helpful
8
Replies

Windows RPC DCOM Overflow sub id 8

yuliang13
Level 1
Level 1

hi,

lately i've been hammered badly by this signature. the funny thing is the destination ports are highports ,etc 1025,5000,etc (non netbios) . i noticed this signature has been firing frequently since ms08-067. anyone having the same experience ? is this a true positive?

thanks in advnce

8 Replies 8

rupadras
Cisco Employee
Cisco Employee

If you are referring to sig 3327 subsig 8, it doesn't have any event-action associated with it by default. By any chance, have you tuned the sig or added an Event Action Override that might be applied to it?

hi,

yes, i'm referring to 3327. I do not think we have tuned it as we have hundreds of IPS deployed.Do you mind if i send you the payload to have a look?

if there are no event-action associated to it, does this means the signature is actually not important ?

cisco IPS seems very ineffective as an IPS

Signature 3327-8 is a meta component and thus only part of a signature. It does not have any event actions by default as the main signature is the one that'll produce an alert once the required components have been triggered by an attack.

A component going off may not be of significance, which is why they are set not not produce alert by default. If you've changed this setting, and are now annoyed by the alerts, I suggest turning it back to default.

Martin Zeiser

IPS Signature Team

Hi martin,

thanks for the reply. I've tried RPC DCOM exploit over this signature. only the subsig 8 was triggered upon the exploit attempt. Do you think this signature is important ?

This signature is relevant to cve-2003-0352, which is the vulnerability the Blaster worm abused. I'm sure there's still a bunch of old machines out there infected by this worm and scanning the Internet for victims.

hi,

yes it's related to that. i'm using the exploit for that vulnerability and it triggered signature 8 only. i think this means sub id 8 should be quite important right?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: