RLOGIN: Username Buffer Overflow

This protocol anomaly triggers when it detects an RLOGIN connection with a specified user name (local or remote) that is too long. This can indicate a buffer overflow attempt.

Extended Description

An rlogin datagram on TCP port 513 that contains a username field greater than 8 bytes constitutes a protocol anomaly. The detection of this message could indicate a network configuration error, or that a buffer overflow attack is being attempted by injecting malformed rlogin datagrams into the network.

References

URL: http://www.faqs.org/rfcs/rfc1282.html

Short Name

RLOGIN:OVERFLOW:USERNAME

Severity

Major

Recommended

False

Recommended Action

None

RLOGIN: Username Buffer Overflow

Extended Description

References

Found a potential security threat?