Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have this log entry from SEP:

2011-04-05T10:52:37+02:00 SymantecServer SomeServer: SomePC,[SID: 23179] 
OS Attack: MS Windows Server Service RPC Handling CVE-2008-4250 detected.  
Traffic has been blocked from this application: C:\WINDOWS\system32\ntoskrnl.exe,
Local: 000000000000,
Remote: ,
Remote: 000000000000,Inbound,TCP,
Intrusion ID: 0,
Begin: 2011-04-05 10:28:37,
End: 2011-04-05 10:28:37,
Occurrences: 1,
Application: C:/WINDOWS/system32/ntoskrnl.exe,
Location: Default,
User: 123456,
Domain: SomeDomain

I want to confirm I understand this correctly. This is TCP inbound communication. Iow the remote IP is trying to expose some vulnerability on the local machine:

So we should be more worried about the remote machine than the local machine. Or is it the other way round?

share|improve this question

4 Answers 4

up vote 2 down vote accepted

Attacker: Victim:

"Inbound" indicates that is the machine under attack (and probably the one generating the log).

share|improve this answer
Your answer is a good one (so I've translated it), but for the future please note that [The official language of the Stack Exchange trilogy is English]. Thanks :-) – voretaq7 Feb 3 '12 at 23:36

Depends what you're trying to fix. You should probably look at the, as it is the one that most likely launched the attack.

share|improve this answer, which I assume to be under your control because of the RFC1918 IP, has probably been compromised. It attempted to exploit a known vulnerability (CVE-2008-4250, which is a buffer overflow attack on RPC handling) on

The way you will handle this depends on what kind of machine is. You might be dealing with a port security issue (someone has connected something unauthorized to your network), a firewall issue (the machine was allowed to be connected but is not under your control), a rogue user (running metasploit or something on your network), or a virus-infected workstation (or server!), among other things.

share|improve this answer

"Inbound" indicates that is the machine under attack and attacker trying to access the vulnerable ntoskrnl.exe.. Its very clear

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.