Symantec™ Security Gateways Reference Guide - Sawmill

308 IDS eventsIntrusion attemptsAffected:No specific targets.False Positives: None known.References:FTP SpecificationsFTP Bad UsernameBase Event:Details:Response:Affected:FTPCLI_USER_WAREZFTP Client logon attempt was made using a “bad” user name (warez). This may indicate an attemptto access an illicit account on the FTP server.The server should be audited for presence of this account.No specific targets.False Positives: None known.References: http://www.whitehats.com (arachNIDS #327)FTP SpecificationsFTP Bounce AttackBase Event:Details:Response:Affected:FTP_BOUNCE_ATTACKThe FTP Bounce attack was detected. This attack may allow a malicious FTP client to redirectattack traffic through a vulnerable FTP server, thereby obfuscating the attack traffic’s true source.A complete audit of the client and server is recommended.No specific targets.False Positives: None known.References:FTP SpecificationsFTP Buffer OverflowBase Event:Details:Response:Affected:FTPCLI_BUFFER_OVERFLOWAn FTP buffer overflow attempt was detected. This indicates an attempt to compromise the server.Location and audit of client and server is recommended. Examination of the packet contents mayprovide some additional information about the particular command.No specific targets.False Positives: None known.References:FTP SpecificationsFTP Buffer OverflowBase Event:Details:Response:FTPCLI_NOOP_BUFFER_OVERFLOWA possible buffer overflow was detected. This indicates than an attempt to compromise the server.In this case an unusually long string of NO-OP codes are detected from the client. NO-OP codes arecommonly used in buffer-overflow attacks to increase the chance of exploit code being executed.Location and audit of client and server is recommended. Examination of the packet contents mayprovide some additional information about the particular command.