Symantec™ Security Gateways Reference Guide - Sawmill

332 IDS eventsIntrusion attemptsOSPF LSID AttackBase Event:Details:References:OSPF_LSID_ATTACKThe link state ID and the advertising router ID of a router-type link state advertisements (LSA)were different. This violation of the RFC is not handled properly by some routing implementationsand may cause a segmentation fault in a receiving router.OSPF RFCDesign and Implementation of a Scalable Intrusion Detection System for the Protection ofNetwork InfrastructureOSPF Max SegNum AttackBase Event:Details:References:OSPF_LSA_MAX_SEQNUMThe OSPF message contained a link state advertisement (LSA) with the sequence number set to themaximum allowed value. This situation almost never occurs in normal network traffic. Manyrouting implementations do not handle purging of records with maximum sequence numbers setand this attack is used to maliciously control the network topology database for up to one hour.OSPF RFCDesign and Implementation of a Scalable Intrusion Detection System for the Protection ofNetwork InfrastructureOverlong UTF-8 CharacterBase Event:Details:Response:Affected:HTTP_UTF8_LONG_CHARWhat appears to be an overly long UTF-8 character was detected. This may be an attempt to exploitthe Microsoft IIS traversal bug.Location and audit of client and server is recommended.No specific targets.False Positives: None known.References:HTTP SpecificationsPHF AccessBase Event:Details:Response:Affected:HTTP_URL_SIG7The HTTP request attempted to access a PHF CGI. PHF was a white pages CGI program distributedwith some older Web servers. It is known to be easily exploitable and should no longer be inwidespread use. This event indicates that a probe for the existence of PHF was detected.Location and audit of client and server is recommended. You should also disable the PHF CGIs onthe server.No specific targets.False Positives: None known.References:CVE-1999-0067