

Rule:

--
Sid:
115-1

--
Summary:
This event is generated when the pre-processor asn1 detects network
traffic that may constitute an attack. Specifically an indefinite asn.1
length encoding was detected.

--
Impact:
Unknown.

--
Detailed Information:
This event is generated when the asn1 pre-processor detects network
traffic that may consititute an attack.

Indefinite Lengths are conceptually like BLOB data.  The upper bit of
the first byte is set to one, and the bottom seven bits are zero.  The
data value follows immediately, and continues until two zero-bytes are
encountered.

More information on this event can be found in the individual
pre-processor documentation README.asn1 in the docs directory of the
snort source. Detailed instructions and examples on how to tune and use
the pre-processor can also be found in the same document.

--
Affected Systems:
	All.

--
Attack Scenarios:

--
Ease of Attack:
Simple.

--
False Positives:
None Known.

--
False Negatives:
None Known.

--
Corrective Action:
Check the target host for signs of compromise.

Apply any appropriate vendor supplied patches.

--
Contributors:
Sourcefire Vulnerability Research Team
Daniel Roelker <droelker@sourcefire.com>
Nigel Houghton <nigel.houghton@sourcefire.com>

--
Additional References:

ASN1 Information Site:
http://asn1.elibel.tm.fr/

--
