Symantec™ Security Gateways Reference Guide - Sawmill

326 IDS eventsIntrusion attemptsAffected:No specific targets.False Positives: None known.References:CVE-1999-0002RPC SpecificationsMS FrontPage BackdoorBase Event:Details:Response:Affected:HTTP_URL_SIG3An attempt to access a well known back door in Microsoft FrontPage was made. A back door may letan intruder into your system.Location and audit of client and server is recommended. You should also contact the server vendorfor any applicable updates.Servers running Microsoft FrontPage.False Positives: None known.References:HTTP SpecificationsMySQL INC AccessBase Event:Details:Response:HTTP_URL_SIG2An attempt to access the pcssmysqladm/incs was detected. This indicates an attempt to exploit anill configured MySQL server that allows for traversal and retrieval of administrative files.Location and audit of client and server is recommended. You should also contact the server vendorfor any applicable updates.Affected: PCCS-Linux MySQLDatabase Admin Tool 1.2.3,1.2.4;NOT vulnerable PCCS-Linux MySQLDatabase Admin Tool 1.2.5.False Positives: None known.References:CVE-2000-0707http://www.whitehats.com (arachNIDS #300)Bugtraq #1557HTTP SpecificationsNessus ProbeBase Event:Details:Response:Affected:HTTP_URL_SIG8A probe from a Nessus scanner was detected. Nessus is a popular vulnerability assessment scanner.While it is intended for internal audit use, it may be used by attackers to locate exploitablevulnerabilities in your network.Responses typically include locating the source of the probe.No specific targets.False Positives: None known.References:Nessus