Symantec™ Security Gateways Reference Guide - Sawmill

384 IDS eventsSuspicious activityAffected:No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed DataBase Event:Details:Response:Affected:HTTP_BAD_REQ_MSGHDRHTTP request headers lines generally consist of a header name followed by a colon and value forthe header. This event indicates that the text of a header name was out of the valid character rangeallowed by the HTTP RFC.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed DataBase Event:Details:Response:Affected:HTTP_BAD_RESP_BYTE_UNITThe Content-Range header field value specified in the HTTP response had an invalid format.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed DataBase Event:Details:Response:Affected:HTTP_BAD_RESP_MSGHDRHTTP response header lines generally consist of a header name followed by a colon and headervalue. This event indicates that the text of a header name was out of the valid character rangeallowed by the HTTP RFC.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed DataBase Event:Details:Response:HTTP_BAD_STATUSTEXTThe text after the server status response (the first line of an HTTP response) did not comply withthe restrictions in the RFC.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended.