<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body >Hi Stefan,<div>Another test if you have few minutes please, </div><div>Could you disable only sid 2011582 and check if always drop please? </div><div>If is repeatable, could you simulate with a wget/curl/fetch User-Agent java like please? (For easy reproduce)</div><div>Could you post suricata.yaml (conf) and signatures ruleset please? (Try reduce conf/sigs to minimal as soon possible)</div><div>Do you use nfqueue / afpacket / pfring ?</div><div>Do you have compiled suricata? What option? </div><div>Regards</div><div>@Rmkml</div><div><br></div><br><br><br>-------- Message d'origine --------<br>De : Stefan Sabolowitsch <Stefan.Sabolowitsch@felten-group.com> <br>Date : <br>A : rmkml <rmkml@yahoo.fr> <br>Cc : oisf-users@lists.openinfosecfoundation.org <br>Objet : Re: [Oisf-users] IPS mode drop Problem on suri 1.4.5R <br> <br><br>Hi all,<br>how can resolve this bug ?<br><br>Stefan<br><br>Am 23.08.2013 10:06, schrieb Stefan Sabolowitsch:<br>> OK, this rule work correctly only "alone" (no drops), without all other<br>> rules.<br>><br>><br>><br>><br>> Am 23.08.13 09:25 schrieb "rmkml" unter <rmkml@yahoo.fr>:<br>><br>>> Hi Stefan,<br>>><br>>> Yes you are certainly right it's a bug,<br>>><br>>> another test if you permit: could you active only sid please ?<br>>> could you drop again ?<br>>><br>>> Regards<br>>> @Rmkml<br>>><br>>><br>>> On Fri, 23 Aug 2013, Stefan Sabolowitsch wrote:<br>>><br>>>> Bonjour Hi , rmkml<br>>>> This will not help.<br>>>> Only this one rule make this Problem.<br>>>><br>>>> Any idea, perhaps a bug in suri ?<br>>>><br>>>> Regards Stefan<br>>>><br>>>><br>>>><br>>>> Am 22.08.13 17:23 schrieb "rmkml" unter <rmkml@yahoo.fr>:<br>>>><br>>>>> Thx Stefan for reply,<br>>>>><br>>>>> Could you try if you disable temporary all drop sig below please ?<br>>>>> (and if you alert sig drop again your network traffic ?)<br>>>>><br>>>>> Regards<br>>>>> @Rmkml<br>>>>><br>>>>><br>>>>> On Thu, 22 Aug 2013, Stefan Sabolowitsch wrote:<br>>>>><br>>>>>> Hi Rmkl,<br>>>>>> i found this drop rules.<br>>>>>><br>>>>>> Regards<br>>>>>> Stefan<br>>>>>><br>>>>>> [root@ipd2 rules]# grep "^drop.*set,ET.http.javaclient.vulnerable"<br>>>>>> *.rules<br>>>>>> emerging-current_events.rules:drop http $EXTERNAL_NET any -> $HOME_NET<br>>>>>> any<br>>>>>> (msg:"ET CURRENT_EVENTS Phoenix Java MIDI Exploit Received By<br>>>>>> Vulnerable<br>>>>>> Client"; flow:established,to_client;<br>>>>>> flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> content:"META-INF/services/javax.sound.midi.spi.MidiDeviceProvider";<br>>>>>> classtype:bad-unknown; sid:2013484; rev:3;)<br>>>>>><br>>>>>> emerging-current_events.rules:drop http $EXTERNAL_NET any -> $HOME_NET<br>>>>>> any<br>>>>>> (msg:"ET CURRENT_EVENTS - Modified Metasploit Jar";<br>>>>>> flow:from_server,established;<br>>>>>> flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> content:"msf|2f|x|2f|Payload"; classtype:trojan-activity; sid:2014560;<br>>>>>> rev:6;)<br>>>>>><br>>>>>> emerging-current_events.rules:drop http $HOME_NET any -> $EXTERNAL_NET<br>>>>>> any<br>>>>>> (msg:"ET CURRENT_EVENTS Incognito/RedKit Exploit Kit vulnerable Java<br>>>>>> payload request to /1digit.html";<br>>>>>> flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> flow:established,to_server;<br>>>>>> urilen:7; content:".html"; http_uri; content:" Java/1"; http_header;<br>>>>>> pcre:"/\/[0-9]\.html$/U"; flowbits:set,et.exploitkitlanding;<br>>>>>> classtype:trojan-activity; sid:2014750; rev:2;)<br>>>>>><br>>>>>> emerging-current_events.rules:drop http $HOME_NET any -> $EXTERNAL_NET<br>>>>>> any<br>>>>>> (msg:"ET CURRENT_EVENTS Unknown java_ara Bin Download";<br>>>>>> flow:established,to_server; content:"java_ara&name="; http_uri;<br>>>>>> content:"/forum/"; http_uri; content:".php?"; http_uri;<br>>>>>> flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> classtype:trojan-activity;<br>>>>>> sid:2014805; rev:2;)<br>>>>>><br>>>>>> emerging-current_events.rules:drop http $EXTERNAL_NET any -> $HOME_NET<br>>>>>> any<br>>>>>> (msg:"ET CURRENT_EVENTS Blackhole obfuscated Java EXE Download by<br>>>>>> Vulnerable Version - Likely Driveby";<br>>>>>> flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> flow:established,to_client;<br>>>>>> content:"|0d 0a 9c 62 d8 66 66 66 66 54|"; classtype:trojan-activity;<br>>>>>> sid:2014909; rev:2;)<br>>>>>><br>>>>>> emerging-current_events.rules:drop http $EXTERNAL_NET any -> $HOME_NET<br>>>>>> any<br>>>>>> (msg:"ET CURRENT_EVENTS Scalaxy Jar file"; flow:to_client,established;<br>>>>>> content:"|0d 0a 0d 0a|PK"; content:"C1.class"; fast_pattern;<br>>>>>> distance:0;<br>>>>>> content:"C2.class"; distance:0;<br>>>>>> flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> classtype:trojan-activity;<br>>>>>> sid:2014983; rev:2;)<br>>>>>><br>>>>>> emerging-current_events.rules:drop http $EXTERNAL_NET any -> $HOME_NET<br>>>>>> any<br>>>>>> (msg:"ET CURRENT_EVENTS SofosFO Jar file 10/17/12";<br>>>>>> flow:to_client,established; file_data; content:"PK"; within:2;<br>>>>>> content:"SecretKey.class"; fast_pattern; distance:0;<br>>>>>> content:"Mac.class";<br>>>>>> distance:0; flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> classtype:trojan-activity; sid:2015812; rev:3;)<br>>>>>><br>>>>>> emerging-current_events.rules:drop tcp $EXTERNAL_NET $HTTP_PORTS -><br>>>>>> $HOME_NET any (msg:"ET CURRENT_EVENTS Metasploit CVE-2012-1723 Path<br>>>>>> (Seen<br>>>>>> in Unknown EK) 10/29/12"; flow:to_client,established; file_data;<br>>>>>> content:"PK"; within:2; content:"cve1723/";<br>>>>>> flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> classtype:trojan-activity;<br>>>>>> sid:2015849; rev:3;)<br>>>>>><br>>>>>> emerging-current_events.rules:drop http $EXTERNAL_NET any -> $HOME_NET<br>>>>>> any<br>>>>>> (msg:"ET CURRENT_EVENTS SofosFO Jar file 09 Nov 12";<br>>>>>> flow:to_client,established; file_data; content:"PK"; within:2;<br>>>>>> content:"SecretKey.class"; fast_pattern:only; content:"Anony";<br>>>>>> pcre:"/^(mous)?\.class/R";<br>>>>>> flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> classtype:trojan-activity; sid:2015876; rev:3;)<br>>>>>><br>>>>>> emerging-current_events.rules:drop http $HOME_NET any -> $EXTERNAL_NET<br>>>>>> any<br>>>>>> (msg:"ET CURRENT_EVENTS RedKit Exploit Kit Vulnerable Java Payload<br>>>>>> Request<br>>>>>> URI (1)"; flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> flow:established,to_server; content:"/33.html"; depth:8; http_uri;<br>>>>>> urilen:8; flowbits:set,et.exploitkitlanding;<br>>>>>> classtype:trojan-activity;<br>>>>>> sid:2015930; rev:2;)<br>>>>>><br>>>>>> emerging-current_events.rules:drop http $HOME_NET any -> $EXTERNAL_NET<br>>>>>> any<br>>>>>> (msg:"ET CURRENT_EVENTS RedKit Exploit Kit vulnerable Java Payload<br>>>>>> Request<br>>>>>> to URI (2)"; flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> flow:established,to_server; content:"/41.html"; depth:8; http_uri;<br>>>>>> urilen:8; flowbits:set,et.exploitkitlanding;<br>>>>>> classtype:trojan-activity;<br>>>>>> sid:2015931; rev:2;)<br>>>>>><br>>>>>> emerging-trojan.rules:drop http $EXTERNAL_NET any -> $HOME_NET any<br>>>>>> (msg:"ET TROJAN Java EXE Download by Vulnerable Version - Likely<br>>>>>> Driveby";<br>>>>>> flowbits:isset,ET.http.javaclient.vulnerable;<br>>>>>> flow:established,to_client;<br>>>>>> content:"|0d 0a 0d 0a|MZ"; byte_jump:4,58,relative,little;<br>>>>>> content:"PE|00<br>>>>>> 00|"; distance:-64; within:4; threshold:type limit,track by_src,count<br>>>>>> 1,seconds 3; classtype:trojan-activity; sid:2013036; rev:7;)<br>>>>>><br>>>>>><br>>>>>><br>>>>>><br>>>>>><br>>>>>> Am 22.08.13 11:01 schrieb "rmkml" unter <rmkml@yahoo.fr>:<br>>>>>><br>>>>>>> Hi Stefan,<br>>>>>>><br>>>>>>> Sorry I don't help,<br>>>>>>><br>>>>>>> but I have a question: can you search on your rules if you have<br>>>>>>> another<br>>>>>>> rule with flowbits but on drop mode please ?<br>>>>>>> (like this: grep "^drop.*set,ET.http.javaclient.vulnerable" *.rules)<br>>>>>>><br>>>>>>> Regards<br>>>>>>> @Rmkml<br>>>>>>><br>>>>>>><br>>>>>>> On Thu, 22 Aug 2013, Stefan Sabolowitsch wrote:<br>>>>>>><br>>>>>>>> Hi all,<br>>>>>>>> I have hereŠ<br>>>>>>>> Executing: suricata --user sguil --group sguil -c<br>>>>>>>> /etc/nsm/Wecker-intern/suricata.yaml -q 1 -l<br>>>>>>>> /nsm/sensor_data/Wecker-intern<br>>>>>>>> 22/8/2013 -- 06:00:26 - <Info> - This is Suricata version 1.4.5<br>>>>>>>> RELEASE<br>>>>>>>> 22/8/2013 -- 06:00:26 - <Info> - CPUs/cores online: 4<br>>>>>>>> 22/8/2013 -- 06:00:26 - <Info> - Enabling fail-open on queue<br>>>>>>>> 22/8/2013 -- 06:00:26 - <Info> - NFQ running in standard ACCEPT/DROP<br>>>>>>>> mode<br>>>>>>>><br>>>>>>>> Have a problem with a rule, i don't understand here.<br>>>>>>>> Although this rule on alert marks, drop suricata the data stream.<br>>>>>>>> If i disable the rule, the data are forwarded (not drop) .<br>>>>>>>><br>>>>>>>> Why ?<br>>>>>>>> Any idea?<br>>>>>>>><br>>>>>>>> Thx<br>>>>>>>> Stefan<br>>>>>>>><br>>>>>>>> rules:<br>>>>>>>> alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY<br>>>>>>>> Vulnerable Java Version 1.6.x Detected"; flow:established,to_server;<br>>>>>>>> content:"Java/1.6.0_"; ht<br>>>>>>>> tp_user_agent; content:!"51"; within:2; http_user_agent;<br>>>>>>>> flowbits:set,ET.http.javaclient.vulnerable; threshold: type limit,<br>>>>>>>> count<br>>>>>>>> 2, seconds 300, track by_s<br>>>>>>>> rc; reference:url,javatester.org/version.html;<br>>>>>>>> classtype:bad-unknown;<br>>>>>>>> sid:2011582; rev:31;)<br>>>>>>>><br>>>>>>>> Fast.log<br>>>>>>>> 08/22/2013-08:36:38.770429 [**] [1:2011582:31] ET POLICY Vulnerable<br>>>>>>>> Java Version 1.6.x Detected [**] [Classification: Potentially Bad<br>>>>>>>> Traffic] [Priority: 2<br>>>>>>>> ] {TCP} 192.168.0.143:4803 -> 156.151.59.19:80<br>>>>>>>><br>>>>>>>> drop.log<br>>>>>>>> 08/22/2013-08:36:38.770429: IN= OUT= SRC=192.168.0.143<br>>>>>>>> DST=156.151.59.19 LEN=221 TOS=0x00 TTL=128 ID=18727 PROTO=TCP<br>>>>>>>> SPT=4803<br>>>>>>>> DPT=80 SEQ=2569271462 ACK=1691<br>>>>>>>> 480634 WINDOW=64240 ACK PSH RES=0x00 URGP=0<br>>>>>>>><br>>>>>>>><br>>>>>>>><br>>>>>><br>>>><br>><br>> _______________________________________________<br>> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> OISF: http://www.openinfosecfoundation.org/<br>><br>><br><br><br></body>