Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 926 / 1026

Table 124: Deep Inspection Alarm Log Entries (continued)
Versions Severity Attack Description Attack Name
sos5.1.0 info This signature detects attempts to login to the MSN network
using an MSN Messenger client. CHAT:MSN:LOGIN-ATTEMPT
sos5.1.0 high This signature detects buffer overflow attempts against the
SQLXML-ASAPI Extension in Microsoft SQL Server 2000.
The SQLXML-ASAPI extension handles data queries over
HTTP (SQLXML HTTP); attackers may connect to the target
host and submit maliciously crafted data to create a buffer
overflow. DB:MS-SQL:SQLXML-ISAPI-OF
sos5.1.0 info This protocol anomaly is a DNS request/reply in which the
question/resource address class is not IN (Internet Address).
Although allowed by the RFC, this should happen only in
rare circumstances and may indicate an exploit attempt. DNS:AUDIT:CLASS-NON-IN
sos5.1.0 info This protocol anomaly is a DNS reply with a resource
specifying a CLASS ID reserved for queries only (QCLASS).
This may indicate an exploit attempt. DNS:AUDIT:QCLASS-UNEXP
sos5.1.0 info This protocol anomaly is a DNS reply with a resource
specifying a TYPE ID reserved for queries only (QTYPE). This
may indicate an exploit attempt. DNS:AUDIT:REP-QTYPE-UNEXPECTED
sos5.1.0 info This protocol anomaly is a DNS reply with a query/reply bit
(QR) that is unset (indicating a query). This may indicate an
exploit attempt. DNS:AUDIT:REP-S2C-QUERY
sos5.1.0 info This protocol anomaly is a DNS request with a query/reply
bit (QR) set (indicating a reply). This may indicate an exploit
attempt. DNS:AUDIT:REQ-C2S-RESPONSE
sos5.1.0 info This protocol anomaly is a client-to-server DNS message
with the recursion-available bit (RA) set. This may indicate
an exploit attempt. DNS:AUDIT:REQ-INVALID-HDR-RA
sos5.1.0 info This protocol anomaly is a DNS request with request type
set to "ANY". DNS:AUDIT:TYPE-ANY
sos5.0.0,
sos5.1.0 high This protocol anomaly is an empty DNS UDP message. This
may indicate an exploit attempt. DNS:EXPLOIT:EMPTY-UDP-MSG
sos5.0.0,
sos5.1.0 high This protocol anomaly is an rdataset parameter to the
dns_message_findtype() function in message.c that is not
NULL. In BIND 9 (up to 9.2.0), attackers may cause a
shutdown on an assertion failure. Note: Common queries in
routine operations (such as SMTP queries) may trigger this
anomaly. DNS:EXPLOIT:EXPLOIT-BIND9-RT
sos5.0.0,
sos5.1.0 high This protocol anomaly is a DNS message with a set of DNS
pointers that form a loop. This may indicate a
denial-of-service (DoS) attempt. DNS:EXPLOIT:POINTER-LOOP
Copyright © 2010, Juniper Networks, Inc. 876
Network and Security Manager Administration Guide