Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 962 / 1016

sos5.1.0 high This signature detects e-mail attachments that contain two
file extensions. Attackers or viruses may send e-mail
attachments that use two file extensions to disguise the
actual file name and trick users into opening a malicious
attachment. POP3:EXT:DOUBLE-DOT-DOT
sos5.1.0 high This protocol anomaly is multiple login failures within a short
period of time between a unique pair of hosts. The default
is 4. POP3:FAILURE:BRUTE-FORCE
sos5.1.0 high This signature detects buffer overflow attempts against an
ActiveX control in Microsoft Outlook. The Local
Troubleshooter ActiveX control has inadequate bounds for
checking for its Query function, and this exploit bypasses
normal Outlook/IE ActiveX security controls. Attackers may
create a malicious Web site that contains a call to this
ActiveX control; this call contains an overly long string that
overflows the control buffer, enabling the attacker to gain
control of the target system with the user privileges. POP3:OUTLOOK:TROUBLE-QUERY-OF
sos5.0.0,
sos5.1.0 high This protocol anomaly is a POP3 APOP command argument
that is too long. This may indicate a buffer overflow attempt. POP3:OVERFLOW:APOP
sos5.1.0 high This protocol anomaly is a message with more than 70
boundary characters. POP3:OVERFLOW:BOUNDARY_OVERFLOW
sos5.0.0,
sos5.1.0 high This protocol anomaly is a POP3 command that exceeds 4
bytes, the standard length for a POP3 command. This may
indicate a nonstandard POP3 client/server or an attacker
has gained command-line access to the server. POP3:OVERFLOW:COMMAND
sos5.1.0 high This protocol anomaly is a mime header content-type with
a name length that is longer than the defined value. The
default value is 128. POP3:OVERFLOW:CONTENT_NAME
sos5.1.0 high This protocol anomaly is a message with a
content_disposition header containing a 'name' attribute
value that is too long. POP3:OVERFLOW:FILENAME2LONG
sos5.0.0,
sos5.1.0 high This protocol anomaly is a text-line from a POP3 client to
the server that is too long. This may indicate a buffer
overflow attempt. POP3:OVERFLOW:LINE
sos5.0.0,
sos5.1.0 high This protocol anomaly is a POP3 PASS command argument
that is too long. This may indicate a buffer overflow attempt. POP3:OVERFLOW:PASS
sos5.0.0,
sos5.1.0 critical This signature detects buffer overflow attempts against
Qpopper, a POP3 server for Unix. Qpopper 3.0beta20 and
earlier versions are vulnerable. POP3:OVERFLOW:QPOP-OF1
sos5.0.0,
sos5.1.0 critical This signature detects a buffer overflow attempt to exploit
a vulnerability in Qpopper. Version 3.0beta30 and many
earlier versions are vulnerable. POP3:OVERFLOW:QPOP-OF2
Copyright © 2010, Juniper Networks, Inc. 912
Network and Security Manager Administration Guide