[7.450][BUG][FIXED] Link in Snort notification leads to Error 404

[Monarch]

Just received a number of (until now unexplainable) IPS alarms, I clicked the link for more information:

Intrusion Protection Alert

An intrusion has been detected. The packet has been dropped automatically.
You can toggle this rule between "drop" and "alert only" in WebAdmin.

Details about the intrusion alert:

Message........: SHELLCODE x86 inc ecx NOOP
Details........: http://www.snort.org/pub-bin/sigs.cgi?sid=1394
Time...........: 2009:06:09-18:41:55
Packet dropped.: yes
Priority.......: 1 (high)
Classification.: Executable code was detected IP protocol....: 6 (TCP)

But http://www.snort.org/pub-bin/sigs.cgi?sid=1394 does not exist!

Regards,
Bastian

[Billybob]

Man you beat me to this... I have noticed it before but was too lazy to point it out. Since snort.org is redesigned, all the old links don't work anymore which sucks since I had a lot of things saved in my favourites that are worthless now.

[Sascha Paris]

Funny...I got the same IPS warning here and wasn't able to find any information to this under snort.org, Astaro IPS Rules or search engines.

Posted today a feature request for such issues
Link IPS, and Malware events in Reports to description

However, up to now I like the updated and tweaked IPS a lot

[Monarch]

Originally Posted by Sascha Paris

Funny...I got the same IPS warning here and wasn't able to find any information to this under snort.org, Astaro IPS Rules or search engines.

Well I get this warnings since today, but they are becoming more and more

Edit: Receiving lots of these warnings when I browse normal web pages. Will disable the rule for now, until I now what it stands for.

[gnujuba]

Originally Posted by Sascha Paris

Funny...I got the same IPS warning here and wasn't able to find any information to this under snort.org, Astaro IPS Rules or search engines.

Posted today a feature request for such issues
Link IPS, and Malware events in Reports to description

However, up to now I like the updated and tweaked IPS a lot

there is this other list: Astaro IPS Rules which ends with -2.8?!

as snort version in 7.450 is 2.8.4.1(*) maybe this is the one to look at - its older though.

anyway, can not find any of the attacks I saw in both lists

(*)
# /var/sec/chroot-snort/sbin/snort --version

,,_ -*> Snort! <*-
o" )~ Version 2.8.4.1 (Build 38) inline
'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html
Copyright (C) 1998-2009 Sourcefire, Inc., et al.
Using PCRE version: 7.7 2008-05-07

[Sascha Paris]

Hip hip hoorray ! I found the trigger for these shellcode IPS log entries, but don't understand, why they happens.

It will every time trigger this "SHELLCODE x86 inc ecx NOOP", when i access a feature in feature.astaro.com via RSS feed in RSS Reader of Firefox.

Destination Port seems to be 8080, but I use transparent proxy, so I don't understand, why there's a access to Port 8080. :confused

[Monarch]

Astaro redirects port 80 to 8080 when using transparent mode.

I also receive the warnings linked with port 8080, but I couldn't find a pattern for when it occurs.

[Billybob]

Hip hip hoorray ! I found the trigger for these shellcode IPS log entries, but don't understand, why they happens.

You are correct, http://feature.astaro.com/pages/1735...to-description is indeed causing the IPS to generate SHELLCODE x86 inc ecx NOOP.

[Billybob]

Well I get this warnings since today, but they are becoming more and more

Funny you mentioned this because my IPS has been fairly quiet till this morning I got two different alerts while surfing.

Message........: WEB-CLIENT wmf file arbitrary code execution attempt
Source IP address: 204.245.162.16 (a204-245-162-16.deploy.akamaitechnologies.com

while surfing cnn.com and then

Message........: WEB-CLIENT Malformed PNG detected iCCP overflow attempt

while surfing another site that I visit normally without any alerts.

[Sascha Paris]

Originally Posted by Monarch

Astaro redirects port 80 to 8080 when using transparent mode.

should have known that, how embarassing