Juniper NETWORK AND SECURITY MANAGER 2010.3, Руководство администратора

Страница: 924 / 1016

Table 124: Deep Inspection Alarm Log Entries (continued)
Versions Severity Attack Description Attack Name
sos5.0.0,
sos5.1.0 medium This signature detects buffer overflow attempts against WS
FTP Server. The code that handles arguments to the SITE
CPWD command, which allows users to change their
password, contains an unchecked string copy. Attackers
may send a maliciously crafted argument in the SITE CPWD
command to overflow the buffer and overwrite the return
address. FTP:WS-FTP:CPWD
sos5.0.0,
sos5.1.0 high This signature detects buffer overflow attempts against the
DELE command in a WU-ftpd server. Wu-ftpd versions 2.4
and prior (Academ beta12-18 included) are vulnerable. This
may be a variation on the ADM exploit; attackers may log in
anonymously using a hardcoded e-mail address as the
password. FTP:WU-FTP:DELE-OF
sos5.0.0,
sos5.1.0 high This signature detects attempts to exploit an input validation
vulnerability in wuFTPd running on FreeBSD. FreeBSD
versions 4.3 and 4.4 are vulnerable. Because user input goes
directly into a format string for a *printf function, attackers
may overwrite data on a stack (i.e. a return address), access
the shellcode pointed to by the overwritten eip, and execute
arbitrary commands. FTP:WU-FTP:FTPD-BSD-X86
sos5.0.0,
sos5.1.0 high This signature detects attempts to exploit a vulnerability in
Wu-ftpd, a software package that provides File Transfer
Protocol (FTP) services for UNIX and Linux systems. Wu-ftpd
versions 2.6.1 to 2.6.18 are vulnerable. Attackers may send
a maliciously crafted pathname in a CWD or LIST command
to the FTP server to execute arbitrary commands as root. FTP:WU-FTP:GLOBARG
sos5.0.0,
sos5.1.0 critical This signature detects attempts to exploit a format string
vulnerability in Wu-ftpd 2.4 running on Solaris 2.8. Attackers
may inject malicious code into the Wu-ftp daemon memory
space; later in the same session, the attacker may exploit a
format string vulnerability in the Ireply() function to access
that code and execute arbitrary commands as root. FTP:WU-FTP:IREPLY-FS
sos5.0.0,
sos5.1.0 high This signature detects attempts to exploit an input validation
vulnerability in wuFTPd running on LINUX. All versions are
susceptible. Because user input goes directly into a format
string for a *printf function, attackers may overwrite data
on a stack, i.e. a return address, access the shellcode pointed
to by the overwritten eip, and execute arbitrary commands.
This same attack may be successful seen against ProFTPD
servers. FTP:WU-FTP:LINUX-OF
sos5.0.0,
sos5.1.0 critical This signature detects buffer overflow attempts against the
realpath() function in Wu-ftpd, a software package that
provides File Transfer Protocol (FTP) services for UNIX and
Linux systems. Wu-ftpd version 2.5.0 and earlier are
vulnerable. Attackers may send a maliciously crafted FTP
pathname to overflow a buffer in realpath() and execute
arbitrary commands with administrator privileges. FTP:WU-FTP:REALPATH-OF
Copyright © 2010, Juniper Networks, Inc. 874
Network and Security Manager Administration Guide