Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 944 / 1026

sos5.0.0,
sos5.1.0 high This signature detects attempts to exploit the Remote Data
Services (RDS) component included in Microsoft Data
Access Components (MDAC) using ActiveDataFactory.
Microsoft IIS IIS 3.x and 4.x are vulnerable. Attackers may
remotely access exposed unsafe methods to execute
arbitrary commands. HTTP:IIS:MDAC-RDS-2
sos5.1.0 high This signature detects buffer overflow attempts against
Microsoft IIS. A maliciously crafted HTTP request can exploit
a buffer overflow condition in mfc42.dll by way of ext.dll.
Attackers may gain local access to an IIS server. HTTP:IIS:MFC-EXT-OF
sos5.0.0,
sos5.1.0 medium This signature detects attempts to create a file on the Web
server by exploiting the newdsn.exe vulnerability in Microsoft
IIS 3.0. HTTP:IIS:NEWDSN-FILE-CREATION
sos5.1.0 high This signature detects chunked POST requests to
NSIISLOG.DLL. Attackers may exploit Windows Media
Services that have logging enabled, and other vulnerabilities
using this method. HTTP:IIS:NSIISLOG-CHUNKED-POST
sos5.0.0,
sos5.1.0 high This signature detects denial-of-service (DoS) attempts
against Microsoft Outlook Web. Attacker may send a long
string of '%' characters as the user name and/or password. HTTP:IIS:OUTLOOK-WEB-DOS
sos5.1.0 medium This signature detects attempts to exploit a vulnerability in
Microsoft IIS 5.0. Attackers may send malicious 'PROPFIND'
requests to the server to crash it. HTTP:IIS:PROPFIND
sos5.1.0 medium This signature detects the sadmind/IIS worm attempting to
infect Microsoft IIS. The sadmind/IIS worm first exploits a
vulnerability in a Solaris system, then attacks Microsoft IIS
Web servers using the Web server folder directory traversal
exploit. HTTP:IIS:SADMIND-WORM-ACCESS
sos5.0.0,
sos5.1.0 medium This signature detects attempts to locate sensepost.exe on
a Microsoft ISS Web Server. Attackers may use a
proof-of-concept hacking tool to break into a vulnerable
Web server, then copy cmd.exe to the Web server script
directory and rename it sensepost.exe to avoid detection by
log viewers. To identify this event, check your Web server
logs for details--if the server returned a '200' to the request,
your Web server may be compromised. HTTP:IIS:SENSEPOST.EXE
sos5.1.0 high This signature detects attempts to exploit a vulnerability in
MS Site Server 2.0 with IIS 4. Attackers may upload content
(including ASP) to the target web site and remotely execute
commands. HTTP:IIS:SITE-SERVER-FILE-UPLD
sos5.1.0 critical This signature detects buffer overflow attempts against
Microsoft IIS WebDAV. Attackers may send a maliciously
crafted WebDAV URL request that contains 65535 or 65536
bytes to the Web server to execute arbitrary code as the
system account. HTTP:IIS:WEBDAV:LOCK-OF
Copyright © 2010, Juniper Networks, Inc. 894
Network and Security Manager Administration Guide