SID 1:1923

Rule Category

PROTOCOL-RPC -- Snort has detected traffic that may indicate the presence of the rpc protocol or vulnerabilities in the rpc protocol on the network.

Alert Message

PROTOCOL-RPC portmap proxy attempt UDP

Rule Explanation

This event is generated when an attempt is made to forward a Remote Procedure Call (RPC) request through the portmapper service. Impact: Information disclosure. This can detect and request RPC services offered. Details: The RPC "callit" procedure allows the portmapper to act as a proxy to forward requests to other RPC services offered by the host. This allows an attacker to call an RPC service on the same host without knowing the port number associated with the RPC service. Ease of Attack: Simple.

What To Look For

No information provided

Known Usage

No public information

False Positives

Known false positives, with the described conditions

According to RFC 1057, this proxy feature supports broadcasts to RPC services using the well-known portmapper port. This rule also generates an event when legitimate hosts attempt to use the proxy feature.

Contributors

Cisco Talos Brian Caswell Judy Novak Nigel Houghton