Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 949 / 1016

sos5.0.0,
sos5.1.0 high This protocol anomaly is an IMAP flag that is too long. This
may indicate a buffer overflow attempt. IMAP:OVERFLOW:FLAG
sos5.0.0,
sos5.1.0 high This signature detects buffer overflow attempts against the
IMAP package included with several Linux distributions.
Attackers may send a long string to the IMAP package to
execute code with daemon-level permissions. IMAP:OVERFLOW:IMAP4-LSUB-OF
sos5.0.0,
sos5.1.0 high This protocol anomaly is an IMAP line (from the client to the
server) that is too long. This may indicate a buffer overflow
attempt. NOTE: Long lines are parsed, which may generate
other IMAP overflow errors. IMAP:OVERFLOW:LINE
sos5.1.0 high This protocol anomaly is an IMAP literal that specifies more
octets than the user-defined maximum. A literal is a
sequence of zero or more octets. The default maximum
number of octets is 65535. IMAP:OVERFLOW:LIT_LENGTH_OFLOW
sos5.0.0,
sos5.1.0 high This protocol anomaly is an IMAP mailbox name that is too
long. This may indicate a buffer overflow attempt. IMAP:OVERFLOW:MAILBOX
sos5.0.0,
sos5.1.0 high This protocol anomaly is an IMAP user password that is too
long. This may indicate a buffer overflow attempt. IMAP:OVERFLOW:PASS
sos5.0.0,
sos5.1.0 high This protocol anomaly is an IMAP reference field that is too
long. This may indicate a buffer overflow attempt. IMAP:OVERFLOW:REFERENCE
sos5.0.0,
sos5.1.0 high This protocol anomaly is an IMAP tag field that is too long.
This may indicate a buffer overflow attempt. IMAP:OVERFLOW:TAG
sos5.0.0,
sos5.1.0 high This protocol anomaly is an IMAP user name that is too long.
This may indicate a buffer overflow attempt. IMAP:OVERFLOW:USER
sos5.1.0 high This protocol anomaly is a literal that specifies a number of
octets containing a character that is not 0 or 9. IMAP:REQERR:INVALID_LITERAL_LEN
sos5.0.0,
sos5.1.0 medium This protocol anomaly is an invalid IMAP tag, i.e., a tag that
begins with a white space or contains non-alphanumeric
characters. This may indicate a nonstandard IMAP client or
command line access to an IMAP server. IMAP:REQERR:REQ-INVALID-TAG
sos5.0.0,
sos5.1.0 medium This protocol anomaly is an IMAP command with too many
arguments. This may indicate a nonstandard IMAP client or
command line access to an IMAP server. IMAP:REQERR:REQ-UNEXPECTED-ARG
Versions Severity Description Key
sos5.1.0 critical This protocol anomaly is a DCOM servername that is longer
than 32 octets in unicode. MS-RPC:DCOM:SVRNAME-2LONG
sos5.1.0 low This anomaly detects a client enumerating MSRPC endpoints
on a windows server. This may indicate a probing scan prior
to a more sophisticated attack. MS-RPC:EPDUMP-SCAN
899 Copyright © 2010, Juniper Networks, Inc.
Appendix E: Log Entries