Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsSuspicious activity379HTTP Campas CGI Passwd AccessBase Event:Details:Response:HTTP_CAMPAS_ACCESSCampas is a sample CGI script shipped with some older versions of NCSA HTTPd, which is anobsolete Web server package.The versions that included the script could not be determined, as the server is no longermaintained; however, version 1.2 of the script itself is known to be vulnerable.The script fails to properly filter user-supplied variables, and as a result, is used to executecommands on the host with the privileges of the Web server. Commands are passed as a variable tothe script, separated by %0a (linefeed) characters. See the exploit for an example.Successful exploitation of this vulnerability is used to deface the Web site, read any files to whichthe server process has access, get directory listings, and execute anything to which the Web serverhas access.Delete the sample script, as it is not necessary for normal Web server function.Affected: NCSA httpd-campas 1.2False Positives: There are no known False Positives associated with this signature.References Security Focus BID: 1975NCSA HTTPd PageNCSA’s “Security Concerns on the Web” PageHTTP cfcache.map AccessBase Event:Details:Response:Affected:HTTP_CFCACHE_MAP_ACCESSAn attempt to access the cfcache.map file was detected. This may reveal information aboutrestricted files on the Web server.Location and audit of client and server is recommended.ColdFusion Server 4.0x.False Positives: None known.ReferencesHTTP SpecificationsHTTP CGI Htmlscript ViewSourceBase Event:Details:Response:HTTP_HTMLSCRIPT_ACCESSMiva's htmlscript CGI program provides a unique scripting language with HTML type tags.Note: htmlscript is an older product that Miva no longer distributes under this name. Versions ofthe htmlscript interpreter (a CGI script) prior to 2.9932 are vulnerable to a file-reading directorytraversal attack, using the relative paths (for example, “../../../../../../etc/passwd”).An attacker would only need to append this path as a variable passed to the script by means of aURL. You can retrieve the contents of any file to which the Web server process has read accessusing this method.Location and audit of client and server is recommended.Affected: Miva htmlscript 2.0.False Positives: None known.References Security Focus BID: 2001Miva Corporation