MS-RPC: Length Conflict

This protocol anomaly is a Microsoft Remote Procedure Call (MSRPC) connectionless message with a fragment length that conflicts with the common header length and the whole message length. Detecting this anomaly can indicate a malicious user might be attacking your system.

Extended Description

An MSRPC connectionless message length conflicting with the TCP packet header length, or with the whole packet length, should be detected.

References

URL: http://windowssdk.msdn.microsoft.com/en-us/library/ms719418.aspx http://www.faqs.org/rfcs/rfc1050.html

Short Name

MS-RPC:ERR:LEN-CONFLICT

Severity

Major

Recommended

False

Recommended Action

None

MS-RPC: Length Conflict

Extended Description

References

Found a potential security threat?