The Sun RPC Preprocessor
Note | This section applies to Snort 2 preprocessors. For information on Snort 3 inspectors, see https://www.cisco.com/go/snort3-inspectors. |
Remote Procedure Call (RPC) normalization takes fragmented RPC
records and normalizes them to a single record so the rules engine can inspect
the complete record. For example, an attacker may attempt to discover the port
where RPC
admind runs. Some
UNIX hosts use RPC
admind to perform
remote distributed system tasks. If the host performs weak authentication, a
malicious user could take control of remote administration. The standard text
rule (GID: 1) with the
Snort ID
(SID) 575 detects this attack by searching for content in specific locations to
identify inappropriate
portmap GETPORT
requests.