SNTP overflow
advICE :Intrusions : 2002907

Summary

An SNTP frame has been seen with an invalid format.

Details

The Simple Network Time Protocol is used to set the system time accurately to a universal clock. This allows you to synchronize your system's time clock to the correct time.

SNTP works in two modes. In one method, the user installs a software program that runs in the background. This will regularly query a time server, and update the system clock appropriately. In the other mode, time servers will broadcast onto the local wire the current time information. Local machines can listen to these broadcasts in order to discover the current time.

This is a popular protocol, becoming more popular on desktops and servers as more and more people desire to set their clocks accurately.

Trigger

The alert triggers when a data field is longer than 250 bytes. This results from a buffer-overflow exploit designed to break into certain UNIX time servers.

parametric information length Length of the data reason Reason for malformed notification data Data in frame

 
Version appeared: 3.0