Juniper NETWORK AND SECURITY MANAGER 2010.3, Руководство администратора

Страница: 965 / 1016

sos5.1.0 high This protocol anomaly is a malformed SMB message in
which the wcount field is larger than the message size. SMB:ERROR:MAL-MSG
sos5.1.0 critical This signature detects attempts to overflow the SMB
Account Name. ISS BlackICE, Proventia, and RealSecure
products are vulnerable to this buffer overflow. A successful
attack could give an attacker complete control of these
systems. SMB:EXPLOIT:ACCOUNT-NAME-OF
sos5.1.0 medium This signature detects a Microsoft Task Scheduler (.job) file
being copied over an SMB network share. Microsoft Windows
XP Service Pack 1 and Microsoft Windows 2000 Service
Pack 2 and earlier are vulnerable. Attackers may open a
malicious .job file in Task Scheduler to execute arbitrary code
and compromise the system. SMB:EXPLOIT:DOT-JOB
sos5.1.0 critical This protocol anomaly is a LANMAN request
(NetServerEnum, NetServerEnum2, or NetShareEnum) over
a named pipe transaction where the max-param-count
and/or the max-data-count of the Transaction header is
zero. Attackers can use this malformed request to crash an
unpatched Microsoft NT, 2000, or XP server. SMB:EXPLOIT:LANMAN-NUKE
sos5.1.0 high This signature detects attempts to exploit a vulnerability in
the Server Message Block File System (SMBFS)
implemented in the Linux kernel. Kernels 2.4 and 2.6 are
vulnerable. Attackers may gain root access on the target
host. SMB:EXPLOIT:LINUX-TRANS2-OF
sos5.1.0 medium This protocol anomaly is an empty Filename field in the
Delete, Rename, Move or Copy SMBs. SMB:EXPLOIT:NULL-FILENAME
sos5.1.0 medium This protocol anomaly is an empty Path field in the Tree
Connect SMB. This may be a misbehaving client or an
attempt to exploit vulnerabilities in the SMB server. SMB:EXPLOIT:NULL-PATH
sos5.1.0 medium This protocol anomaly is an empty Service field in the Tree
Connect SMB. This may be a misbehaving client or an
attempt to exploit vulnerabilities in the SMB server. SMB:EXPLOIT:NULL-SERVICE
sos5.1.0 critical DI has detected a suspiciously large registry key in the
OpenKey function executed using a named-pipe transaction.
Large key sizes in the OpenKey function can cause the
winlogon.exe process in Window NT 4.0 to crash. SMB:EXPLOIT:REGISTRY-DOS
sos5.1.0 medium This signature detects SMB requests for pathnames that
attempt to traverse the server root. Samba 3.0.5 and earlier
versions are vulnerable. Malicious users can send "get", "put",
and "dir" commands to a Samba server to access files
outside the shared directories. SMB:EXPLOIT:SAMBA-DIR-TRAV
sos5.1.0 medium Microsoft Windows Samba File Sharing Resource Exhaustion
Vulnerability SMB:EXPLOIT:WINBLAST-DOS
915 Copyright © 2010, Juniper Networks, Inc.
Appendix E: Log Entries