Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsIntrusion attempts319HTTP MSFrontpage fpcount B0Base Event:HTTP_FPCOUNT_EXPLOITDetails: A buffer overflow exists in fpcount.exe, a site hit counter included with Microsoft FrontPage 98Server Extensions prior to version 3.0.2.1330.To determine the version number of the Microsoft FrontPage Server Extensions on a Web server,open the Web with the Microsoft FrontPage Explorer and click the Tools | Web Settings command.On the Configuration tab, check the Microsoft FrontPage Server Extensions Version field.Response:An update to 3.0.2.1330 was available from the vendor as part of their product support. However,Microsoft FrontPage 98 is no longer supported by the vendor. Consider upgrading to a newerversion.Affected: Microsoft FrontPage 98 Server Extensions prior to version 3.0.2.1330False Positives: None known.References: BID: 2252CAN-1999-1376HTTP WinApache Bat ExecBase Event:Details:Response:Affected:HTTP_BAT_FILE_PIPEA vulnerability has been discovered in the batch file handler for Apache on Microsoft Windowsoperating systems.Special characters (such as |) may not be filtered by the batch file handler when a Web request ismade for a batch file. As a result, a remote attacker may be able to execute arbitrary commands onthe host running the vulnerable software. This may be exploited via a specially crafted Web requestwhich contains the arbitrary commands to be executed.Note that Web servers on Microsoft Windows operating systems normally run with SYSTEMprivileges. The consequences of exploitation is that a remote attacker may be able to fullycompromise a host running the vulnerable software.The 2.0.x series of Apache for Microsoft Windows ships with a test batch file which may beexploited to execute arbitrary commands. Since this issue is in the batch file handler, any batch filewhich is accessible via the Web is appropriate for the purposes of exploitation.This issue has been addressed in Apache 1.3.24 and 2.0.34-BETA for Microsoft Windows operatingsystems. Administrators are advised to upgrade.Please refer to the following link for the patch:Apache Software FoundationApache Software Foundation Apache 1.3.6win32 to 1.3.23win32Apache Software Foundation Apache 2.0.28-BETA win32 and 2.0.32-BETA win32False Positives: The likelihood of a false positive only exists if the piping is used by certain users to performlegitimate requests.References:CAN-2002-0061BID: 4335IMAP Authentication Buffer OverflowBase Event:Details:References:IMAP_AUTH_BUFFOVERFLOWIMAP authentication buffer overflow event.CVE-1999-0005