Bigfix DSS triggering Code Red Intrusion Attacks

Usage and Config Platform
1

(imported topic written by jfschafer)

Our Symantec Endpoint Protection Intrusion Prevention system is catching DSS SAM traffic on the Bigfix server as Code Red attack. Here’s the traffic that is being caught. Looks to be coming from the HTTPD.exe DSS process based on the path of the offending exe that’s causing the traffic. I need to figure out how to try to reproduce which means I need to know what could possible trigger this type of traffic. I could exclude this rule from IPS as I want Symantec update their IPS rule as I assume this is a false positive. In order to do that, I have to try to recreate the traffic and capture with wireshark to send to Symantec. Any ideas on how to do that based on what any of you know of what httpd.exe does as part of the DSS (SUA) fuctions?

Here’s the traffic that triggered the alert.

127.0.0.1:6669/query.idq?CiTemplate=…/…/…/…/…/winnt/win.ini%20%20%

20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%

20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%

20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%

20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%

20%20

Intrusion Payload URL: N/A

Event Description:

SID: 20330

HTTP IIS ISAPI Extension (Code Red)

attack blocked. Traffic has been blocked for this application:

\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\BIGFIX

ENTERPRISE\DSS\RAILS\APACHE\BIN\HTTPD.EXE

Event Type: Intrusion Prevention

Hack Type: 0

Severity: Critical

Application Name: /DEVICE/HARDDISKVOLUME1/PROGRAM FILES/BIGFIX

ENTERPRISE/DSS/RAILS/APACHE/BIN/HTTPD.EXE

2

(imported comment written by mcalvi91)

if you know the other end of the connection, you can turn the SEP FW to packet capture and capture it that way.

3

(imported comment written by jfschafer)

It’s traffic to itself (127.0.0.1). Problem is it’s happened only twice in the last month so I’m trying to figure out a way to trigger it. Otherwise, packet capture in SEP itself will fill up and overwrite itself. Wireshark would fill the harddrive if I left it running. So if I can get a way to trigger it, then I can capture as I trigger. It’s definately related to the DSS SUA piece.