Symantec™ Security Gateways Reference Guide - Sawmill

386 IDS eventsSuspicious activityHTTP Malformed URLBase Event:Details:Response:Affected:HTTP_BAD_REQUESTThe HTTP request contained characters out of the valid character range as specified by the HTTPRFC. (For example, terminal control characters or delete characters in the request.)If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed URLBase Event:Details:Response:Affected:HTTP_BAD_REQURL0The URL in an HTTP CONNECT request did not conform to the HTTP RFC. This may be an attemptto exploit certain server vulnerabilities.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed URLBase Event:Details:Response:Affected:HTTP_BAD_REQURL1The URL in an HTTP request did not conform to the HTTP RFC. This may be an attempt to exploitcertain server vulnerabilities.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP Malformed URLBase Event:Details:Response:Affected:HTTP_BAD_REQURL2The URL in an HTTP request did not conform to the HTTP RFC. This may be an attempt to exploitcertain server vulnerabilities.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: None known.ReferencesHTTP Specifications