Symantec™ Security Gateways Reference Guide - Sawmill

388 IDS eventsSuspicious activityHTTP Malformed URLBase Event:Details:Response:Affected:HTTP_NEWLINES_IN_REQUEST_PATHThe HTTP URL observed did not conform to the HTTP RFC. This may be an attempt to exploitcertain server vulnerabilities.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: None known.ReferencesHTTP SpecificationsHTTP SCO Skunkware ViewSource TraversalBase Event:HTTP_VIEW_SOURCE_ACCESSDetails: view-source is a script included with the httpd package, which is bundled with Skunkware 2.0.Skunkware 2.0 is a variant of the UNIX operating system distributed by Santa Cruz Operations.A problem with the view-source script may allow remote access to restricted files. The problemoccurs in the handling of slashes and dots when appended to the view-source script.By appending a series of double-dots and slashes to a query using the view-source script, it ispossible to traverse the directory structure on a Web server. In turn, viewing the contents of thedirectories and the files of the httpd process, which the UID can read, is possible.This flaw enables a user with malicious motives to read files on a remote system and gatherintelligence for an attack against the system, as well as other potentially sensitive information.Response:Location and audit of client and server is recommended.Affected: SCO Skunkware 2.0.False Positives: None known.References Security Focus BID: 2251HTTP sourcewindow.cfm AccessBase Event:Details:Response:Affected:HTTP_SOURCEWINDOW_CFMAn attempt to access the sourcewindow.cfm file was detected. This script may reveal informationabout restricted files on the Web server.Location and audit of client and server is recommended.Macromedia ColdFusion Server 4.0x.False Positives: None known.ReferencesHTTP SpecificationsHTTP Tilde AccessBase Event:Details:Response:HTTP_TILDE_ACCESSAn attempt to access a file via the relative path of ‘~’ was detected. This may allow an intruderaccess into the Web server’s home directory with older Web servers.If seen in sufficient volume or variation audit of client and server is recommended.