Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 933 / 1026

Table 124: Deep Inspection Alarm Log Entries (continued)
Versions Severity Attack Description Attack Name
sos5.0.0,
sos5.1.0 critical This signature detects attempts to exploit a format string
vulnerability in ProFTPD. Versions 1.2pre6 and earlier are
vulnerable. FTP:PROFTP:PPC-FS2
sos5.0.0,
sos5.1.0 medium This signature detects denial-of-service (DoS) attempts
against ProFTPD. Because ProFTPD uses inadequate
globbing algorithms, attackers may send wildcards in the
argument of a maliciously crafted command to DoS the
server. FTP:PROFTP:PROFTPD-GEN-GLOB-DOS
sos5.0.0,
sos5.1.0 high This signature detects attempts to exploit a vulnerability in
ProFTPD. Version 1.2.0pre* is vulnerable. Attackers may send
multiple SIZE requests with a static pathname to create a
denial-of-service (DoS). FTP:PROFTP:SIZE-DOS2
sos5.0.0,
sos5.1.0 high This signature detects attempts to exploit a vulnerability in
ProFTPD. Versions 1.2.0rc* and 1.2.0pre* are vulnerable.
Attackers may send a maliciously crafted USER command
to create a denial-of-service (DoS). FTP:PROFTP:USER-DOS
sos5.0.0,
sos5.1.0 medium This signature detects denial-of-service (DoS) attempts
against GNU ls. If the FTP daemon uses a vulnerable version
of GNU ls, attackers may send an oversized width parameter
to GNU ls to cause the server CPU utilization to temporarily
reach 100% and exhaust system memory. This condition
can persist for several minutes depending on the width
specified. FTP:REQERR:GNULS-WIDTH-DOS
sos5.0.0,
sos5.1.0 medium This protocol anomaly is an FTP command with an
incomplete argument list, such as a USER command with
no user name, a RETR command with no file name, etc. This
may indicate command line access to the FTP server or an
exploit attempt. FTP:REQERR:REQ-MISSING-ARGS
sos5.1.0 critical This signature detects attempts to exploit a vulnerability in
the ServU FTP server CHMOD command. The CHMOD
command is typically used to change the permissions of a
file on the server. Attackers may send an overly long filename
argument to the CHMOD command to execute arbitrary
code with system privileges. FTP:SERVU:CHMOD-OVERFLOW
sos5.0.0,
sos5.1.0 medium This signature detects attempts to login to an FTP server
using the "root" account. This may indicate an attacker trying
to gain root-level access, or it may indicate poor security
practices. FTP typically uses plain-text passwords, and using
the root account to FTP could expose sensitive data over
the network. FTP:USER:ROOT
883 Copyright © 2010, Juniper Networks, Inc.
Appendix E: Log Entries