MS-RPC: Invalid Authentication Length

This protocol anomaly is a Microsoft Remote Procedure Call (MSRPC) message with an authentication length that is larger than the entire MSRPC message payload length. Detecting this anomaly can indicate a malicious user might be attacking your system.

Extended Description

MSRPC messages that have authentication field lengths longer than the MSRPC message length should be detected. They are protocol anomalies.

References

URL: http://en.wikipedia.org/wiki/MSRPC http://www.faqs.org/rfcs/rfc1050.html http://windowssdk.msdn.microsoft.com/en-us/library/ms719418.aspx

Short Name

MS-RPC:ERR:INV-AUTH-LEN

Severity

Major

Recommended

False

Recommended Action

None

MS-RPC: Invalid Authentication Length

Extended Description

References

Found a potential security threat?