Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsSignatures363MSSQL StackOverflowBase Event:Details:Response:MSSQL_STACKOVERFLOWA vulnerability was discovered in Microsoft SQL Server 2000 that could allow remote attackers togain access to the target hosts.A problem in the SQL Server Resolution Service makes it possible for a remote user to executearbitrary code on a vulnerable host. An attacker could exploit a stack-based overflow in theresolution service, by sending a maliciously crafted UDP packet to port 1434.UDP port 1434 is designated as the Microsoft SQL Monitor port. Clients connect to this port todiscover how connections to the SQL Server should be made. When the SQL Server receives apacket starting with byte 0x04, followed by four “A” characters, the SQL server attempts to open thefollowing registry key:HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQLServer\AAAA\MSSQLServer\CurrentVersion.If a large number of bytes are appended to the packet, the buffer overflow condition is triggered,and as a result, the attacker can overwrite the key areas in memory and obtain control over the SQLServer process. Custom crafting the exploit code to execute the arbitrary instructions in thesecurity context of the SQL Server may be possible. This action may provide a remote attacker withlocal access on the underlying host.The W32.SQLEXP.Worm Microsoft SQL Server exploited this vulnerability.Contact Microsoft for the latest updates.Affected: Microsoft Data Engine 2000Microsoft SQL Server 2000 SP2Microsoft SQL Server 2000 SP1Microsoft SQL Server 2000False Positives: None known.ReferencesCAN-2002-0649Security Focus BID: 5311Symantec Security Response: W32.SQLExp.WormMicrosoft Security Bulletin: MS-039WuFTPd Heap OverflowBase Event:Details:Response:A remote user can cause a heap overflow in wu-ftpd by sending a specially crafted sequence ofcommands to it. This vulnerability affected a large number of UNIX vendors.Contact your vendor for a patch.Affected: Versions of wu-ftpd prior to 2.6.2.False Positives: This signature can produce false positives when users give commands with tilde (~) characters.References Security Focus BID: 3581CVE-2001-0550Red Hat Advisory