Rule:--Sid:1881--Summary:This event is generated when an attempt is made to exploit a known vulnerability on a web server or a web application resident on a webserver.--Impact:Information gathering and system integrity compromise. Possible unauthorizedadministrative access to the server. Possible execution of arbitrary code of the attackers choosing in some cases.--Detailed Information:This event is generated when an attempt is made to compromise a hostrunning a Web server or a vulnerable application on a web server.Many known vulnerabilities exist for each implementation and the attack scenarios are legion.Some applications do not perform stringent checks when validating thecredentials of a client host connecting to the services offered on ahost server. This can lead to unauthorized access and possibly escalatedprivileges to that of the administrator. Data stored on the machine canbe compromised and trust relationships between the victim server and other hosts can be exploited by the attacker.--Affected Systems:	All systems using a web server.--Attack Scenarios:Many attack vectors are possible from simple directory traversal toexploitation of buffer overflow conditions.--Ease of Attack:Simple. Exploits exist.--False Positives:None known.--False Negatives:None known.--Corrective Action:Ensure the system is using an up to date version of the software and hashad all vendor supplied patches applied.Check the host logfiles and application logs for signs of compromise.--Contributors:Sourcefire Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:--