Symantec™ Security Gateways Reference Guide - Sawmill

324 IDS eventsIntrusion attemptsIRC WormBase Event:Details:Response:Affected:IRCCLISER_PR0N_WORMThe IRC worm “pr0n” was detected. This is a signature detection event for a well known IRC worm.The pattern detected is “dcssend pron.bat”.If seen in sufficient volume or variation and other suspicious factors exist audit of client and serveris recommended. Examination of the packet contents may provide some additional informationabout the particular command.No specific targets.False Positives: None known.References:IRC SpecificationsIRC WormBase Event:Details:Response:Affected:IRCCLISER_SEPTIC_WORMThe IRC worm “septic” was detected. This is a signature detection event for a well known IRCworm.If seen in sufficient volume or variation and other suspicious factors exist audit of client and serveris recommended. Examination of the packet contents may provide some additional informationabout the particular command.No specific targets.False Positives: None known.References:IRC SpecificationsIRIX webdist CGI AccessBase Event:Details:Response:HTTP_URL_SIG13An attempt to access the webdist CGI was detected. There is a known vulnerability in thewebdist.cgi program that allows the sender of the request to execute commands on the Web serverhost with the privileges of the httpd daemon.Location and audit of client and server is recommended. If you intend to use these CGIs you shouldcontact the vendor for any applicable updates.Affected: SGI IRIX 5.0, 5.1, 5.2, 5.3, 6.1, 6.2, and 6.3.False Positives: None known.References:CVE-1999-0039HTTP SpecificationsJava ServerSocketBase Event:Details:Response:HTTP_BODY_SIG3A Java instruction opening a server socket was detected inside the body of an HTTP request. Thismay indicate that someone is attempting to have a Web browser execute Java code that opens up alistening socket to circumvent network security measures.Location and audit of client and server is recommended.