[SID: 20628] MSRPC Mutiple Headers detected ?

[Migration User]

There is very little information on this issue, but since yesterday's update we've seen a lot of alerts regarding this from one location.  Nothing else seems out of the ordinary on the PC's we've taken a peek at.  Just wondering if anyone else has seen this, or knows a bit more detail about the underlying issue.  Symantec's article on this is very thin.  

[Migration User]

 Since Vista does not properly pass the application name for ntoskrnl.exe to the NTP firewall, the firewall may not correctly be detecting it.  The same may also be true for XP SP3.

To fix this you may follow the below steps

From the main menu along the left side in the SEPM, choose Policies.

Under View Policies, click on Firewall. 

Double click on the policy you wish to edit.  A new window will open.

On the left side, click on Rules.

At the bottom, click on Add Blank Rule.

Name the rule Allow SMB Network Browsing.

Under Application, right-click on Any, then choose Edit....

Next to file name, manually type in C:\Windows\System32\ntoskrnl.exe (or browse to it using the Browse button).

Ensure Action is set to Allow.

Use the Move Up or Move Down button to place the rule above any other that would otherwise block this application.  It is recommended to place this rule in the Administrative area, above the blue line

[Migration User]

Thanks for the information.  We only have a couple of Vista clients, but we do have a fair number (probably 40% or more) that are XP SP3.  I've just changed this policy in our test group, and will roll it out to the rest if it pans out.

[Scott K]

We have seen one Vista computer have hundreds of false-positive this morning associated with this update from yesterday.  The specific event description is:

    [SID: 20628] MSRPC Mutiple Headers detected. Traffic has been allowed from this application: C:\WINDOWS\system32\ntoskrnl.exe

The remote host is Windows Server 2003 R2 x64, which is printer server for us.  Our other Vista (~10) computers don't have this problem and neither does our Windows XP SP3 (~300) computers.  I would rather not create a firewall exception for MSRPC Multiple Headers threat (http://www.symantec.com/business/security_response/attacksignatures/detail.jsp?asid=20628), which would leave our clients valuable to this type of attack.  I would like to see Symantec fix the problem with their recent update.

[Migration User]

 This is a known IPS false positive..
 Follow the above workaround this will fix later on.

[Migration User]

I have a workstation with XP Sp2 that is getting this error. I also get the error above on multiple workstations, but sometimes it says svchost.exe instead of ntoskrnl.exe

[SID: 20628] MSRPC Mutiple Headers detected. Traffic has been allowed from this application: C:\WINDOWS\system32\svchost.exe

I agree with Scott.  Is allowing this a good idea? I know you say "Follow the above workaround this will fix later on", but when? If you are going to fix it soon, I would rather live with the alert than be more vulnerable. As Scott pointed out, Symantecs info on this IPS event looks pretty serious (my favorite is the last line, but I will give Symantec a break since it seemed to just come out):

MSRPC Mutiple Headers

 

 

 

 

Severity: Medium

This attack could pose a moderate security threat. It does not require immediate action.

Description

This signature detects multiple RPC headers in one single TCP packets.Popular attacks tools have been known to use this pattern to evade IPS engines

Additional Information

This signature detects multiple RPC headers in one single TCP packets.Popular attacks tools have been known to use this pattern to evade IPS engines

Affected

• Windows

Possible False Positives

There are no known false positives associated with this signature. (giggle)

 

[Migration User]

You can contact Symantec Tech support. So that they can collect the needed data & resolve this issue as soon as possible. 

[Migration User]

I don't think this should be credited as a solution just yet. Maybe a workaround, but no solution was given.

[Scott K]

The problem lies with IPS definitions dated 2009-10-20 rev.001.  My simple workaround was to rollback to pervious IPS definitions by following the instructions I found at http://service1.symantec.com/support/ent-security.nsf/docid/2007111515160948 (note: these instructions don’t match MR5 SEPM interface, but were close enough for me to follow).  I also needed to manually run LiveUpdate on SEPM for the clients to get the rolled backed IPS definitions.

I agree with Senrats that the firewall exception suggestion by Happytohelp is only a temporary workaround and not a solution.  Also I don’t have the time to help Symantec troubleshoot their own faultily definitions and they should do better testing before releasing definitions.

[Migration User]

>[SID: 20628] MSRPC Mutiple Headers detected. Traffic...


"Mutiple" ???  where is gone the "L" :)))   Maybe will come as well in next IPS release?

[Migration User]

I didn't even catch that! 

[Migration User]

I am still seeing this problem with some of my clients. Has the FIXED IPS DEFINITIONS been released or not? Any clarity on this.

[Migration User]

@Amrut: 

Yes, should be solved now with:

Security Update 221 - for Symantec Client Security
Security Update 121 - for Symantec Endpoint Security

See: http://www.symantec.com/business/security_response/securityupdates/list.jsp?fid=sep

for updates.

--cheers

Luca

[Scott K]

The IPS definitions dated 2009-10-26 rev.018 resolves the false-positive for [SID: 20628] MSRPC Mutiple Headers detected, but now has false-positives for [SID: 21960] MSRPC Spooler GetPrinterData DoS detected. Now it appears to affect client Windows computers that aren't joined to our domain when connecting to our Windows Server 2003 R2 x64 printer server. When will Symantec get this correct?