Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsSuspicious activity383Affected: Microsoft IIS 3.0.False Positives: None known.References Security Focus BID: 1818IIS 3.0 newdsn.exe allows remote creation of arbitrary filesHTTP IIS Source Code View AttemptBase Event:Details:Response:Affected:HTTP_IIS_OBTAIN_CODEThis vulnerability may reveal source code to certain scripts on Microsoft IIS servers.Location and audit of client and server is recommended.Microsoft IIS Web serversFalse Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed DataBase Event:Details:Response:Affected:HTTP_BAD_CONTENT_LENGTHThe Content-Length header field value specified in the HTTP response had an invalid format.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed DataBase Event:Details:Response:Affected:HTTP_BAD_CONTENT_RANGEThe Content-Range header field value specified in the HTTP response had an invalid format.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed DataBase Event:Details:Response:HTTP_BAD_MSGHDR_TEXTHTTP headers lines generally consist of a header name followed by a colon and value for theheader. This event indicates that the text of the header value was out of the valid character rangeallowed by the HTTP RFC.If seen in sufficient volume or variation, audit of client and server is recommended.