Signature Detail
Short Name |
MS-RPC:ERR:INV-AUTH-LEN |
|---|---|
Severity |
High |
Recommended |
No |
Category |
MS-RPC |
Release Date |
2004/02/24 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
MS-RPC: Invalid Authentication Length
This protocol anomaly is a Microsoft Remote Procedure Call (MSRPC) message with an authentication length that is larger than the entire MSRPC message payload length. Detecting this anomaly can indicate a malicious user might be attacking your system.
Extended Description
MSRPC messages that have authentication field lengths longer than the MSRPC message length should be detected. They are protocol anomalies.
References