Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsIntrusion attempts331Affected: Microsoft IIS 5.0Microsoft IIS 4.0Microsoft IIS 3.0Microsoft Personal Web Server 3.0Microsoft Personal Web Server 1.0False Positives: None known.References: Security Focus BID: 1806CVE-2001-0884Symantec Write-up for W32.Nimda.E@mmNNTP Exploit AttemptBase Event:Details:Response:Affected:NNTPCLI_BUFFER_OVERFLOW_ATTEMPTA possible buffer overflow attempt was detected from a NNTP client. An unchecked buffer exists inthe routine that handles logon information in the Cassandra NNTP v1.10 server. Entering a logonname that consists of over 10,000 characters will cause the server to stop responding until theadministrator restarts the application.Audit of the server and verification of product patch level is recommended. Examination of thepacket contents may provide some additional information about the particular command.Cassandra NNTP v1.10 serverFalse Positives: None known.References: Security Focus BID: 1156CVE-2000-0341NNTP SpecificationsNPH Test CGI AccessBase Event:Details:Response:Affected:HTTP_URL_SIG4The HTTP request URL attempted to access generic NPH test scripts that were shipped with someversions of apache. This is a concern since many test and demo scripts shipped with Web serversare notorious for not being implemented with an eye towards network security and may beexploited.Location and audit of client and server is recommended. You should also disable the test scripts onthe server.No specific targets.False Positives: None known.References:CVE-2001-0045HTTP Specifications