Symantec™ Security Gateways Reference Guide - Sawmill

334 IDS eventsIntrusion attemptsRlogin Long TERM VariableBase Event:Details:Response:Affected:RLOGIN_LONG_TERMINALThe TERM field (terminal type) specified by the client was unusually long. This may indicate anattempt to perform a buffer overflow attack on the server.If seen in sufficient volume or variation audit of client and server is recommended. Examination ofthe packet contents may provide some additional information about the particular command.No specific targetsFalse Positives: None known.References:Rlogin SpecificationsRSH Exploit AttemptBase Event:Details:Response:Affected:RSH_FROOT_EXPLOIT_ATTEMPTEDA logon name of “-froot” was used. This flag is passed to the login program to bypass logoncredentials and log in as root on vulnerable hosts.If seen in sufficient volume or variation location and audit of client and server is recommended.Examination of the packet contents may provide some additional information about the particularcommand.AIX 3.x, Linux kernel.False Positives: None known.References:CVE-1999-0113http://www.whitehats.com (arachNIDS #386)http://www.whitehats.com (arachNIDS #387)SMTP Buffer Overflow AttemptBase Event:Details:Response:Affected:SMTP_BUFFER_OVERFLOW_ATTEMPTAn overflow attempt was detected against the SMTP daemon. This usually indicates that anattacker is attempting sendmail overflow attacks. A buffer overflow is usually an attempt to gainaccess to the system by having the targeted service execute code on the attacker’s behalf whichmodifies the system in some way.Response typically involves locating the source and verifying if it is a legitimate client or not. If yoususpect the attack was successful, an audit of the victim system is also useful.No specific targets.False Positives: None known.References:CVE-1999-0203SMTP SpecificationsSMTP Exploit AttemptBase Event:Details:Response:SMTP_CLIENT_PIPE_EXPLOIT_ATTEMPTAn attempt was made to send mail to an account that started with a pipe (“|”). This may indicatethat an attempt is being made to trick the SMTP daemon into executing a local program.Location and audit of client and server is recommended.