?? 1050.txt
字號:
Rule:--Sid:1050--Summary:This event is generated when a request is made to a webserver using the the command 'GETPROPERTIES'. This may be an indication that a buffer overflow attack may be in process.--Impact:If successful, this attack will allow attackers to run code of their choosing on the victim server.--Detailed Information:The web publishing feature in iPlanet Web Server 4.1 is vulnerable to a buffer overflow.--Affected Systems:iPlanet Web Server 4.1 up to Service Pack 8--Attack Scenarios:An attacker can spawn a remote shell on the server and execute any command they desire.--Ease of Attack:Difficult. Exploit code does not appear to exist as of June 2003, so anattacker would need to write the code themselves.--False Positives:Legimate uses of web publishing.--False Negatives:This vulnerability can be exploited using any number of web publishing commands, however this rule only generates an event on one specific command (GETPROPERTIES).--Corrective Action:Disable web publishing or upgrade your web server software.--Contributors:Sourcefire Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>Snort documentation contributed by Kevin Peuhkurinen <kevin.peuhkurinen@hepcoe.com>-- Additional References:NTBugtraq Archive:http://archives.neohapsis.com/archives/ntbugtraq/2001-q2/0035.html--
?? 快捷鍵說明
復(fù)制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -