Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 948 / 1026

sos5.1.0 high This protocol anomaly is an HTTP header with an
authorization line that exceeds the user-defined maximum.
The default authorization line length is 128. HTTP:OVERFLOW:AUTH-OVFLW
sos5.0.0,
sos5.1.0 critical This protocol anomaly is an HTTP message that has a chunk
length in a Transfer-Encoding: chunk request that is greater
than 0x7fffffff. Apache servers 1.3 to 1.3.24 and 2.0 to 2.0.36
are vulnerable. Attackers may cause a denial-of-service
(DoS) or execute arbitrary code on the server. HTTP:OVERFLOW:CHUNK-LEN-OFLOW
sos5.1.0 critical This protocol anomaly is an invalid data chunk length in an
HTTP request that uses chunked encoding. The chunked
encoding transfer method sends data length requests
followed by data chunks that match the negotiated data
lengths. Attackers may cause a stack overflow and execute
arbitrary code on the server. HTTP:OVERFLOW:CHUNK-OVERFLOW
sos5.1.0 medium DI has detected a suspiciously long Connection header. HTTP:OVERFLOW:CONNECTION
sos5.1.0 medium DI has detected a suspiciously long Content-Encoding
header. HTTP:OVERFLOW:CONTENT-ENCODING
sos5.1.0 medium DI has detected a suspiciously long Content-Language
header. HTTP:OVERFLOW:CONTENT-LANGUAGE
sos5.1.0 medium DI has detected a suspiciously long Content-Length header. HTTP:OVERFLOW:CONTENT-LENGTH
sos5.1.0 medium DI has detected a suspiciously long Content-Location header. HTTP:OVERFLOW:CONTENT-LOCATION
sos5.1.0 medium DI has detected a suspiciously long Content-MD5 header. HTTP:OVERFLOW:CONTENT-MD5
sos5.1.0 critical This protocol anomaly is a missing line break after a specified
data length in an HTTP request using content length transfer.
The content length transfer method sends the specified data
length in the BODY of the request followed by a line break. HTTP:OVERFLOW:CONTENT-OVERFLOW
sos5.1.0 medium This protocol anomaly is a Content-Type header length that
exceeds the user-defined maximum. The default length is
64. HTTP:OVERFLOW:CONTENT-TYPE
sos5.1.0 medium This protocol anomaly is an HTTP Cookie header length that
exceeds the user-defined maximum. The default length is
8192. HTTP:OVERFLOW:COOKIE
sos5.0.0,
sos5.1.0 high This protocol anomaly is an HTTP header field that is too
long, and may indicate a buffer overflow attempt. HTTP:OVERFLOW:HEADER
sos5.1.0 medium This protocol anomaly is an HTTP Host header length that
exceeds the user-defined maximum. The default length is
64. HTTP:OVERFLOW:HOST
sos5.1.0 high This signature detects buffer overflow attacks against the
HTTPa daemon. Attackers may send a maliciously crafted
HTTP GET request to the host to overflow the buffer. HTTP:OVERFLOW:HTTPA-OF1
Copyright © 2010, Juniper Networks, Inc. 898
Network and Security Manager Administration Guide