Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsIntrusion attempts317HTTP JJ CGI Cmd ExecBase Event:Details:Response:HTTP_JJ_CGI_EXPLOITJJ is a sample CGI program distributed with the NCSA HTTPd servers. It directly passes unfiltereduser data to the /bin/mail program, and as such, it is used to escape to a shell using the ~ characteron systems with a /bin/mail that allows for this.The attacker must know the password that the program requests, though by default, the programuses HTTPdRocKs or SDGROCKS. These default passwords must be changed in the program’ssource code.The consequence of a successful exploit is a shell with the UID of the server.Remove the offending program, jj, from /cgi-bin.Affected: Rob McCool jj.c 1.0False Positives: None known.References: Security Focus BID: 2002HTTP Long Host FieldBase Event:Details:Response:Affected:HTTP_LONG_HOST_NAMEThe HTTP traffic contained a very long host name. This may be an attempt to exploit certain servervulnerabilities.If seen in sufficient volume or variation and other suspicious factors exist audit of client and serveris recommended.No specific targets.False Positives: None known.References:HTTP Specifications