Symantec™ Security Gateways Reference Guide - Sawmill

442 IDS eventsSuspicious activityNNTP Malformed DataBase Event:Details:Response:Affected:NNTPSER_INVALID_ASCIIThe NNTP server responded with characters outside the ASCII range allowed in a response. ValidASCII characters are x00 - 0x7f inclusive. It is possible this indicates an attempt to compromise theserver.The packet contents should be examined and the server should be audited.No specific targets.False Positives: It is possible this is a news client or server using an unofficial protocol extension or non-compliantNNTP implementation.ReferencesNNTP SpecificationsNNTP Malformed DataBase Event:Details:Response:Affected:NNTPSER_INVALID_TEXTThe NNTP server responded with text outside the expected character range. The expectedcharacter range includes ASCII characters x00 - 0x7f inclusive. It is possible this indicates anattempt to compromise the server.The packet contents should be examined and the server should be audited.No specific targets.False Positives: It is possible this is a news client or server using an unofficial protocol extension or non-compliantNNTP implementation.ReferencesNNTP SpecificationsOSPF “Hello” Invalid OptionsBase Event:Details:ReferencesOSPF_HELLO_INVALID_OPTSThe options specified in the OSPF Hello message were invalid. This violation of the standard couldindicate an attempt to compromise the protocol.OSPF SpecificationsOSPF “Hello” Malformed Neighbor FieldsBase Event:Details:ReferencesOSPF_HELLO_BAD_NEIGHBORThe neighbor fields specified in the OSPF Hello message were malformed. This violation of thestandard could indicate an attempt to compromise the protocol.OSPF SpecificationsOSPF “Hello” Short PacketBase Event:Details:ReferencesOSPF_HELLO_SHORT_PACKETThe OSPF Hello message was shorter than minimum required length. This violation of thestandard could indicate an attempt to compromise the protocol.OSPF Specifications