Symantec™ Security Gateways Reference Guide - Sawmill

314 IDS eventsIntrusion attemptsHTTP ASP DataSuffix RequestBase Event:Details:Response:HTTP_IIS_DATA_ACCESSMicrosoft Internet Information Services (IIS) and other NT Web servers contain a vulnerabilityallowing remote attackers to obtain the requested Active Server Pages (ASP) files.ASP pages are executed on the server side and the results are sent to a user's browser. However,when an attacker appends the string, “::$DATA” when requesting an ASP page, IIS will respond byreturning the contents of the ASP page to the attacker. This is due to IIS improperly handlingrequests for alternate data streams.If an attacker directly requests a file with its complete data stream name, an attacker’s Webbrowser will be able to view the contents of the requested file. An attacker can use the obtainedinformation to launch other attacks against a vulnerable system.We strongly recommend that users of Microsoft IIS upgrade to the latest version. Microsoftsuggests, as a work around, that administrators disable read access to any script files.Patches for other vendors are available at their respective Web sites.For services not meant for public access, limit access to the trusted hosts and subnets only.This vulnerability may result in the disclosure of database credentials or other sensitive data.Ensure that the accounts used by Web applications have minimal privileges and Read only accesswhen possible.This will limit the immediate consequences of account compromise. Enabling connection poolingand similar features, if available, may eliminate the need to include credentials in the ASP files.Affected: Microsoft IIS 3.0Microsoft IIS 4.0Microsoft Personal Web Server 2.0Microsoft Personal Web Server 3.0Microsoft Personal Web Server 4.0Microsoft Windows NT 4.0False Positives: None known.References: Security Focus BID: 149Microsoft Security Bulletin (MS98-003)HTTP Beck ExploitBase Event:Details:Response:Affected:HTTP_URL_SIG9An unusually long string of forward slash characters has been detected in an HTTP request URL.This may indicate use of the “Beck” exploit against Apache HTTP servers.Location and audit of client and server is recommended. You should also contact the server vendorfor any applicable updates.No specific targets.False Positives: None known.References:HTTP Specifications