RE: [ISSForum] Can this signatures threshold be modified: smb_filename_overflow?

[Palmer, Paul (ISSAtlanta)]

Title: Message

Scott,

 

Here is an excerpt from a new generation of documentation we are currently developing. It is an HTML document, so I apologize in advance if the listserv modifies or filters it out. Also, I believe the full document is being made available through a Technical Support Knowledge Base article this week. This is definitely a pre-release document, so it has plenty of warts. Even so, your feedback is welcome.

 

Paul

 

pam.file.maxname

Description

Maximum expected length of a file name before triggering an issue. The issue varies with the protocol involved. FTP traffic triggers FTP_Filename_Overflow. TFTP traffic triggers TFTP_Filename_VeryLong. SMB traffic triggers SMB_Filename_Overflow or SMB_Unicode_Filename_Overflow. IMAP version 4 traffic triggers IMAP_Long_Mbox.

Type	number
Default Value	150
Minimum Value	1
Maximum Value	2147483647
Effected Events	IMAP_Long_Mbox IIS_FTP_Session_Status_DoS FTP_NLST_Overflow FTP_Stor_Very_Long FTP_Stat_Very_Long FTP_Size_Very_Long FTP_Rnto_Very_Long FTP_Rnfr_Very_Long FTP_Rmd_Very_Long FTP_Retr_Very_Long FTP_Restart_Very_Long FTP_Passive_Very_Long FTP_Mlst_Very_Long FTP_Mkd_Overflow FTP_Commands_With_Binary FTP_Mdtm_Very_Long FTP_Glob_Implementation FTP_Delete_Very_Long FTP_Cwd_Overflow POP_Filename_Overflow Email_Mime_Filename_Overflow SMB_Unicode_Filename_Overflow SMB_Filename_Overflow FTP_Filename_Overflow TFTP_Filename_VeryLong

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Johnson, Scott
Sent: Monday, November 03, 2003 6:24 PM
To: [EMAIL PROTECTED]
Subject: [ISSForum] Can this signatures threshold be modified: smb_filename_overflow?

 

 

 

Scott Johnson, CISSP, GSEC

ERCOT  Cyber Security

Office  512-248-3152

Cell     512-917-9844

-----Original Message-----
From: Johnson, Scott
Sent: Monday, November 03, 2003 10:29 AM
To: [EMAIL PROTECTED]
Subject: How to modify smb_filename_overflow threshold

Is this signature configurable? If so how?

 

Scott Johnson, CISSP, GSEC

ERCOT  Cyber Security

Office  512-248-3152

Cell     512-917-9844

<<logo_iss_hrz.gif>>