Symantec™ Security Gateways Reference Guide - Sawmill

336 IDS eventsIntrusion attemptsAffected: Sendmail versions 5.2 to 8.12.7False Positives: None known.References: Security Focus BID: 6991CAN-2002-1337CERT: CA-2003-07SNMP Malformed BER/ASN.1 data encodingBase Event:Details:SNMP_ASN1_DATALENGTH_IMPOSSIBLE_STATEThis represents an internal error and should never occur.SNMP Malformed BER/ASN.1 data encodingBase Event:Details:Response:Affected:SNMP_ASN1_DATALENGTH_RIDICULOUS_WIDTHAn element of BER encoded ASN.1 data specified an integer larger than 32 bits for the data length.SNMP data should never require numbers this large to describe their length, and indicates either anon-conforming SNMP implementation or an intrusion attempt.Location and audit of victim is recommended.Hosts running SNMP agents or managers.False Positives: None known.References:RFC 1155 - SNMP v1 SpecificationsRFC 1157 - SNMP v1 SpecificationsRFC 1212 - SNMP v1 SpecificationsRFC 1901 - SNMP v2c SpecificationsRFC 1902 - SNMP v2c SpecificationsRFC 1903 - SNMP v2c SpecificationsRFC 1904 - SNMP v2c SpecificationsRFC 1905 - SNMP v2c SpecificationsRFC 1906 - SNMP v2c SpecificationsRFC 1907 - SNMP v2c SpecificationsRFC 1908 - SNMP v2c SpecificationsRFC 2571 - SNMP v3 SpecificationsRFC 2572 - SNMP v3 SpecificationsRFC 2573 - SNMP v3 SpecificationsRFC 2574 - SNMP v3 SpecificationsRFC 2575 - SNMP v3 SpecificationsSNMP FAQSNMP Malformed BER/ASN.1 dataBase Event:Details:Response:SNMP_ASN1_DATALENGTH_VALUE_TOO_LARGEAn element of BER encoded ASN.1 data specified a data field size that was too large for its indicatedprimitive type.Location and audit of victim is recommended.