Symantec™ Security Gateways Reference Guide - Sawmill

360 IDS eventsSignaturesHTTP IIS ISAPI ExtensionBase Event:Details:Response:The worm uses a buffer overflow vulnerability in the idq.dll, which runs at the System securitylevel, when handling URL requests. Once an attacker establishes a session on the Web server andcauses a buffer to overflow, that attacker could perform virtually any function on that server.Contact Microsoft for the latest patches.Affected: Microsoft IIS 4.0 and 5.0Microsoft Personal Web Server 4.0Microsoft Index Server 2.0Indexing Service in Windows 2000False Positives: This signature can produce false positives when users give commands with tilde (~) characters.References Security Focus BID: 2880CVE-2001-0500Microsoft Security Bulletin: MS01-033Symantec Security Response: CodeRed WormHTTP MDAC IIS Component QueryBase Event:Details:Response:HTTP_MDAC_QUERYMicrosoft Data Access Components (MDAC) contains a buffer overflow vulnerability in a RemoteData Services (RDS) component. The server side RDS component affected is called the RDS DataStub, while the client side is called the Data Space control.Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code, or atthe very least, cause a denial-of-service.Contact Microsoft for the latest patches.Affected: Microsoft Data Access Components (MDAC) 2.1Microsoft Data Access Components (MDAC) 2.5Microsoft Data Access Components (MDAC) 2.6Microsoft Internet Explorer 5.01Microsoft Internet Explorer 5.5Microsoft Internet Explorer 6.0False Positives: None known.ReferencesCAN-2002-1142Microsoft Security Bulletin: MS02-065CERT Advisory: CA-2002-33