MS-RPC: Invalid Authentication Pad Length

This protocol anomaly is an Microsoft Remote Procedure Call (MSRPC) message with authentication padding length plus authentication section length that is larger than the entire MSRPC message payload length. Detecting this anomaly can indicate a malicious user might be attacking your system.

Extended Description

MSRPC messages whose authentication padding length plus authentication section length are longer than the length of the message are protocol anomalies and should be detected.

References

URL: http://windowssdk.msdn.microsoft.com/en-us/library/ms719418.aspx http://en.wikipedia.org/wiki/MSRPC

Short Name

MS-RPC:ERR:INV-AUTH-PAD-LEN

Severity

Major

Recommended

False

Recommended Action

None

MS-RPC: Invalid Authentication Pad Length

Extended Description

References

Found a potential security threat?