Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsIntrusion attempts315HTTP Bizdb Command ExploitBase Event:Details:Response:HTTP_BIZDB_CGI_EXPLOITBizDB is a Web database integration product using perl CGI scripts. One of the scripts, bizdbsearch.cgi,passes a variable’s contents to an unchecked open() call and can therefore be made toexecute commands at the privilege level of the Web server.The variable is dbname, and if it is passed a semicolon followed by shell commands, they will beexecuted.This vulnerability cannot be exploited from a browser, as the software checks for a referrer field inthe HTTP request. However, you can create a valid referrer field and send programmatically, or bymeans of a network utility, such as netcat.This problem has been fixed in the most recent version of BizDB.Affected: CNC Technology BizDB 1.0False Positives: None known.References: Security Focus BID: 1104BizDB Home PageHTTP IIS ASP ChunkEncoding DOSBase Event:Details:Response:Affected:HTTP_IIS_CHUNK_ENCODING_BOFUnchecked buffer in chunked transfer encodings can cause DoS.If an attacker does a PUT or GET request and sets a large buffer for chunked transfer encoding theservice will hang.The server will only recover when it is restarted or the remote user cancels the session.Fixes available:For IIS 4.0http://download.microsoft.com/download/iis40/Patch/4.2.739.1/NT4/EN-US/chkenc4i.exeFor IIS 4.0 Alphahttp://download.microsoft.com/download/iis40/Patch/4.2.739.1/ALPHA/EN-US/chkenc4a.exeMicrosoft IIS 4.0 AlphaMicrosoft IIS 4.0False Positives: None known.References: BID: 1066CVE: CVE-2000-0226MS: FQ00-018