Symantec™ Security Gateways Reference Guide - Sawmill

372 IDS eventsSuspicious activityFTP Malformed DataBase Event:Details:Response:Affected:FTP_BAD_PORT_CMD_IPNUMAn invalid IP address argument to the FTP PORT command was detected. This could indicate anattempt to compromise the server.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.No specific targets.False Positives: It is also possible the client or server is using an unofficial extension or a non-compliantimplementation of FTP.ReferencesFTP SpecificationsFTP Malformed DataBase Event:Details:Response:Affected:FTP_BAD_RANDOM_COMMANDA FTP command was sent to the server that was not composed of alphabetic characters. No FTPcommands should be composed of non-alphabetic characters. This may indicate a compromisedserver.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.No specific targets.False Positives: It is possible this is a client or server using an unofficial extension or non-compliantimplementation.ReferencesFTP SpecificationsFTP Malformed DataBase Event:Details:Response:Affected:FTP_INVALID_UTF8Invalid UTF-8 character encoding has been detected in an FTP session. Bytes in a UTF-8 characterafter the character length specification fall into a limited range; this event is recorded if theseencoding characters fall outside that range. It is possible this indicates an attempt to compromisethe server.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.No specific targets.False Positives: It is possible this is a non-compliant UTF-8 encoding implementation.ReferencesFTP Specifications