Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 931 / 1026

Table 124: Deep Inspection Alarm Log Entries (continued)
Versions Severity Attack Description Attack Name
sos5.0.0,
sos5.1.0 critical This signature detects buffer overflow attempts against the
FreeBSD FTP daemon. FreeBSD-4.2 is vulnerable. Attackers
may submit a malicious STAT request that contains file
globbing characters to execute arbitrary code on the target
host with administrator privileges. FTP:OVERFLOW:FREEBSD-FTPD-GLOB
sos5.0.0,
sos5.1.0 high This protocol anomaly is an incoming FTP line that is too
long. This may indicate an attempt to overflow the server. FTP:OVERFLOW:LINE_TOO_LONG
sos5.0.0,
sos5.1.0 critical This signature detects buffer overflow attempts against ftpd
in OpenBSD. OpenBSD versions 2.7 and 2.8, FTP code
revisions 1.49 to 1.79 are vulnerable. Attackers with write
access may exploit the replydirname() function in
BSD-based ftpd daemons to gain root access. FTP:OVERFLOW:OPENBSD-X86
sos5.0.0,
sos5.1.0 high This protocol anomaly is an FTP client password that
exceeds the length threshold. This may indicate a malicious
FTP client attempting to overflow the server. FTP:OVERFLOW:PASS_TOO_LONG
sos5.0.0,
sos5.1.0 critical This signature detects attempts to exploit a realpath
vulnerability in ProFTPD and wuFTPd running on LINUX.
Versions ProFTPD 1.2pre1 and earlier and wuFTPd 2.4.2 (beta
18) VR9 and earlier are susceptible. Attackers may gain write
access, remotely create long pathnames, and overflow the
buffer to gain root access. FTP:OVERFLOW:PATH-LINUX-X86-1
sos5.0.0,
sos5.1.0 critical This signature detects attempts to exploit a realpath
vulnerability in ProFTPD and wuFTPd running on LINUX.
Versions ProFTPD 1.2pre1 and earlier and wuFTPd 2.4.2 (beta
18) VR9 and earlier are susceptible. Attackers may gain write
access, remotely create long pathnames, and overflow the
buffer to gain root access. FTP:OVERFLOW:PATH-LINUX-X86-2
sos5.0.0,
sos5.1.0 critical This signature detects attempts to exploit a realpath
vulnerability in ProFTPD and wuFTPd running on LINUX.
Versions ProFTPD 1.2pre1 and earlier and wuFTPd 2.4.2 (beta
18) VR9 and earlier are susceptible. Attackers may gain write
access, remotely create long pathnames, and overflow the
buffer to gain root access. FTP:OVERFLOW:PATH-LINUX-X86-3
sos5.0.0,
sos5.1.0 high This protocol anomaly is a pathname in an FTP command
(RETR, STOR, APPE, SMNT, RNFR, RNTO, DELE, RMD, MKD,
STAT, CWD, LIST, NLST) that exceeds the length threshold.
This may be an attempt to overflow the server. FTP:OVERFLOW:PATH-TOO-LONG
sos5.0.0,
sos5.1.0 high This protocol anomaly is an argument in the FTP SITE
command that exceeds the length threshold. This may be
an attempt to overflow the server. FTP:OVERFLOW:SITESTRING-2-LONG
sos5.0.0,
sos5.1.0 high This protocol anomaly is a username in an FTP connection
that exceeds the length threshold. This may be an attempt
to overflow the server. FTP:OVERFLOW:USERNAME-2-LONG
881 Copyright © 2010, Juniper Networks, Inc.
Appendix E: Log Entries