?? 545.txt
字號:
Rule: --Sid: 545--Summary: This event is generated when an attempt is made to navigate in an FTP sessions to a hidden directory named "/ ".--Impact: Unauthorized file storage. An attacker may attempt to navigate on an FTP server to the "/ " directory to list or store unauthorized files such as unlicensed software.--Detailed Information: An attacker may attempt to hide unauthorized files in a hidden directory named "/ ". This hidden directory is hard to discover, permitting attackers to store unauthorized "warez" files, such as unlicensed or pirated software. --Affected Systems: FTP servers--Attack Scenarios: An attacker may navigate to the hidden directory named "/ " to list or store unauthorized files.--Ease of Attack: Simple.--False Positives: It is remotely possible that an authorized directory exists named "/ ".--False Negatives: Hidden directories other than those named "/ " may be used to store "warez" files.--Corrective Action: Assign restrictive permissions to all directories so unauthorized users cannot navigate or write to them.Regularly monitor directories for sudden or drastic increased use of space.--Contributors: Original rule writer unknownModified by Brian Caswell <bmc@sourcefire.com>Snort documentation contributed by Chaos <c@aufbix.org>Sourcefire Research TeamJudy Novak <judy.novak@sourcefire.com>-- Additional References:--
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -