snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

源代码在线查看: 1149.txt

软件大小: 771 K
上传用户: lihuitao1987
关键词: snort Snort 2.4 入侵检测
下载地址: 免注册下载 普通下载 VIP

相关代码

				Rule:  								--				Sid:				1149								--				Summary:				This event is generated when an attempt is made to access Wwwcount 				(count.cgi), a very popular CGI program used to track website usage.								--				Impact:				Will allow access as with the privileges of the user running the 				process.								--				Detailed Information:				In particular, it enumerates the number of hits on given webpages and 				increments them on a 'counter'. In October of 1997 two remotely 				exploitable problems were discovered with this program. The first 				problem was somewhat innocuous in that it only allowed remote users to 				view .GIF files they were not supposed to have access to. This may be 				dangerous if the site contains sensitive data in .GIF files such as 				demographic/financial data in charts etc.								The second and most serious problem is a buffer overflow in QUERY_STRING				enviroment variable handled by the program. In essence a remote user can				send an overloy long query to the program and overflow a buffer in order				to execute their own commands as whatever privilege level the program is				running as.								--				Attack Scenarios:				Simple HTTP GET request.								--				Ease of Attack:				Simple. Exploit code available								--				False Positives:				A none vulnerable version of the application will generate events as the				rule only looks for access to count.cgi during a established connection.								--				False Negatives:								--				Corrective Action:				If you are running version 2.3 of Wwwcount it is suggested you upgrade 				immediately. In the meantime you may wish to consider removing the 				execution bit on this program. Versions 2.4 and above of this software 				are available at: 								http://www.fccc.edu/users/muquit/Count.html 								--				Contributors:				Sourcefire Research Team				Brian Caswell 				Nigel Houghton 				Snort documentation contributed by Neal Timm 								-- 				Additional References:								--							

相关资源