Symantec™ Security Gateways Reference Guide - Sawmill

320 IDS eventsIntrusion attemptsIMAP Authentication Type Buffer OverflowBase Event:Details:References:IMAP_AUTH_TYPE_BOFIMAP buffer overflow of authentication type event.CVE-1999-0005IMAP Buffer OverflowBase Event:Details:IMAP_URL_TOO_LONGThe URL provided as part of an IMAP exchange was too long. This indicates a possible bufferoverflow attempt, which may crash a vulnerable system or give an attacker unauthorized access.IMAP Login Buffer OverflowBase Event:Details:IMAP_CLI_USERID_QUOTED_TOO_LONGA quoted UID presented to the server by the client was longer than 100 characters.IMAP Login Buffer OverflowBase Event:Details:IMAP_CLI_USERID_TOO_LONGA UID presented to the server by the client was longer than 100 characters.IMAP Login Buffer OverflowBase Event:Details:IMAP_URL_USER_TOO_LONGA URL UID presented to the server by the client was longer than 100 characters.IMAP Mailbox Buffer OverflowBase Event:Details:References:IMAP_MAILBOX_BOFA mailbox name longer than 512 chars was detected. This is considered unusual and is flagged as apossible buffer overflow exploit attempt.CVE-1999-0005Intel NOPsBase Event:Details:Response:Affected:HTTP_URL_SIG0Intel NOP instructions have been detected in an HTTP URL. This represents a possible bufferoverflow attempt.Location and audit of client and server is recommended.No specific targets.False Positives: None known.References:HTTP Specifications