Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 941 / 1016

sos5.0.0 medium This signature detects attempts to exploit a vulnerability in
Mantis, an open source Web-based bug tracking system.
Mantis 0.17.3 and earlier versions are vulnerable. Attackers
may send a maliciously crafted URL to cause the Web server
to download PHP code from a remote server, allowing the
attacker to execute arbitrary code with the permissions of
the user that is running the Web server daemon. HTTP:PHP:MANTIS-ARB-EXEC2
sos5.0.0,
sos5.1.0 medium This signature detects attempts to exploit the vulnerable
mlog.phtml script. Attackers may remotely access arbitrary
files on the Web server. HTTP:PHP:MLOG-SCREEN
sos5.1.0 medium This signature detects attempts to exploit a known
vulnerability in the PHP Hytertext Processor (PHP) scripting
language used on many Unix/POSIX-based web servers.
PHP does not properly check for an encoded NULL character
(%00) within parameters passed to it. Because PHP does
not properly filter the HTML for malicious content, attackers
may post HTML that contains malicious code to a
PHP-enabled web site. When other users visit the web site,
the malicious code runs on their web browser with
credentials allowed for the site by that user. HTTP:PHP:NULL-CHAR-IN-TAG
sos5.0.0,
sos5.1.0 high This signature detects attempts to exploit the vulnerable
admin.php3 script in Phorum. Attackers may remotely send
a maliciously crafted string to the script, change the
administrative password of the board without user
verification, and access restricted files on the local system. HTTP:PHP:PHORUM:ADMIN-PW-CHG
sos5.0.0,
sos5.1.0 high This signature detects access to the vulnerable read.php3
script installed with Phorum. Because the script does not
validate input, attackers may execute arbitrary SQL
statements to modify the database contents, insert new
entries, create and drop tables, etc. HTTP:PHP:PHORUM:READ-ACCESS
sos5.0.0,
sos5.1.0 high This signature detects attempts to exploit a vulnerability in
the PHP Phorum bulletin board system. Attackers may
remotely execute arbitrary commands with the privileges of
the HTTP server. HTTP:PHP:PHORUM:REMOTE-EXEC
sos5.1.0 high This signature detects attempts to exploit a vulnerability in
phpBB. Attackers may send a malformed HTTP request to
phpBB to force phpBB to execute arbitrary perl commands
on the server with Web server permissions. HTTP:PHP:PHPBB:HIGHLIGHT-EXEC
sos5.1.0 high This signature detects attempts to exploit a vulnerability in
phpBB. Attackers may send a malformed HTTP request to
phpBB to force phpBB to execute arbitrary perl commands
on the server with Web server permissions. HTTP:PHP:PHPBB:HIGHLIGHT-EXEC2
sos5.1.0 low This signature detects attempts to inject SQL code into a
request to phpBB, a popular open-source bulletin board
application written in php. Attackers may send a maliciously
crafted request that supplies SQL commands to the
pm_sql_user parameter, changing database values and
escalating client privileges. HTTP:PHP:PHPBB:PM_SQL_USR
891 Copyright © 2010, Juniper Networks, Inc.
Appendix E: Log Entries