Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsSuspicious activity385Affected:No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed DataBase Event:Details:Response:Affected:HTTP_UNKNOWN_STATUSThis event indicates that the status response that appears in the first line of an HTTP serverresponse did not comply with the format specified by the RFC.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed RequestBase Event:Details:Response:Affected:HTTP_MISSING_HOSTAn HTTP 1.1 request was detected which did not contain the Host request-header. This is aviolation of the HTTP 1.1 standard and may indicate an attempt to compromise the server.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed Transport EncodingBase Event:Details:Response:Affected:HTTP_BAD_CHUNKED_HEXThe HTTP traffic contained badly formatted encoding. This may be an attempt to exploit certainserver vulnerabilities.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed Transport EncodingBase Event:Details:Response:Affected:HTTP_NO_CRLF_AFTER_CHUNKThe HTTP traffic was missing not properly terminated. This may be an attempt to exploit certainserver vulnerabilities.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: None known.ReferencesHTTP Specifications