Symantec™ Security Gateways Reference Guide - Sawmill

296 IDS eventsDenial-of-ServiceTable B-1Alphabetical listing of base events types and their associated page (Continued)Base EventPageTELNET_ROOT_LOGIN_FAILED 505TELNET_SGI_FMTSTRING_VULN 351TELNET_WINGATE_PROMPT 506TOMCAT_CROSS_SITE 361W32_NIMDA_A_MM 328W32_NIMDA_E_MM 330WIN_DNS_DATA_AFTER_END 506Denial-of-ServiceEcho/Chargen FloodBase Event:Details:Response:Affected:COUNTER_BAD_SERVICES_DOSEcho or chargen traffic has been detected. This is flagged as an event because echo and chargen arelargely deprecated protocols and their heavy usage should be considered an unusual event. Anattacker can use echo and chargen services to perform a denial-of-service attack. The attackeroften locates a host running these services and then sends traffic to them designed to force thehost to send a reply to a secondary victim host. Done in volume, this can create a denial-of-serviceattack. If the flood is traced back, it leads only to the primary victim host.Response to echo/chargen floods typically involves locating the flooding host first and disablingthese services. Note that the original traffic to the primary victim is forged in this case so thesource addresses do not provide any information useful for locating the true source. If it is possibleto trace the traffic back to the source, the source can be shut down and possibly prevent furtherattacks.This attack tends to target UNIX systems (as the primary victim).False Positives: None known.References:CVE-1999-0103CERTFinger DOSBase Event:Details:Response:Affected:FINGER_FORWARDING_ATTEMPTA finger request was made that included a finger forwarding attempt. These requests are used toflood the resources on the target host by creating a finger request loop.If seen in sufficient volume or variation, location and audit of client and server is recommended. Ifa flood is currently active, you can use network filters to mitigate the effect.No specific targets.False Positives: None known.References:CVE-1999-0105http://www.whitehats.com (arachNIDS #251)Finger Specifications