TMS zl Module IPS/IDS Signature Reference Guide RLX.10.2.2.94

ProCurve TMS zl Module IPS/IDS Signature
Reference Guide Version RLX.10.2.2.94
12
with the privileges of the http daemon (root or nobody). It allows remote command execution via shell metacharacters
due to insufficient input validation in architext_query.pl script.
Signature ID: 70
Faxsurvey cgi vulnerability
Threat Level: Warning
Industry ID: CVE-1999-0262
Bugtraq: 2056 Nessus: 10067
Signature Description: Hylafax is a popular fax server software package designed to run on multiple UNIX operating
systems. Unpatched version of Hylafax 4.0 pl2 ships with an insecure script, faxsurvey, which allows remote command
execution with the privileges of the web server process. This can be exploited simply by passing the command as a
parameter to the script. Consequences could include web site defacement, exploiting locally accessible vulnerabilities
to gain further privileges, etc.
Signature ID: 71
FormHandler cgi vulnerability
Threat Level: Warning
Industry ID: CVE-1999-1051 CVE-1999-1050 Bugtraq: 799 Nessus: 10075
Signature Description: Matt Wright FormHandler.cgi is a form handling script that helps in validation and management
of user submitted data. Any file that the Matt Wright FormHandler.cgi 2.0 has read access to (the cgi is typically run as
user 'nobody' on Unix systems) can be specified as an attachment in a reply email. This could allow an attacker to gain
access to sensitive files such as /etc/passwd simply by modifying the form document.
Signature ID: 75
FrontPage 97/98 Htimage.exe buffer overflow vulnerability
Threat Level: Warning
Industry ID: CVE-2000-0122 CVE-2000-0256 Bugtraq: 1117 Nessus: 10376
Signature Description: Two components of FrontPage 97 and 98 Server Extensions, Htimage.exe and Imagemap.exe,
contain unchecked buffers. If carefully-chosen arguments were supplied to these components, they could be made to
run code via a classic buffer overrun vulnerability. <br>The buffer overflow occurs when remote htimage.exe cgi is
given the request : /cgi-bin/htimage.exe/]long string]?0,0
Signature ID: 76
Access to Microsoft Frontpage Extensions vulnerability
Threat Level: Warning
Industry ID: CVE-1999-0386 CVE-2000-0114 CVE-2000-0260 Bugtraq: 1108,989,1109 Nessus: 10077,10369
Signature Description: FrontPage extensions provide the user with the ability to remotely create and manipulate web
site files on the server. Frontpage Extensions extensions in Microsoft InterDev 1.0 and Microsoft FrontPage 98 Server
Extensions for IIS allows a remote attacker to read files on the server by using a nonstandard URL. To be specific, Two
dlls (dvwssr.dll and mtd2lv.dll) include an obfuscation string that manipulates the name of requested files. Knowing
this string and the obfuscation algorithm allows anyone with web authoring privileges on the target host to download
any .asp or .asa source on the system (including files outside the web root, through usage of the '../' string). This
includes users with web authoring rights to only one of several virtual hosts on a system, allowing one company to
potentially gain access to the source of another company's website if hosted on the same physical machine.
Signature ID: 77
Access to Microsoft Frontpage _vti_pvt directory vulnerability
Threat Level: Warning
Industry ID: CVE-1999-0386 CVE-2000-0260 Bugtraq: 1108,989,1109 Nessus: 10078,10369
Signature Description: FrontPage extensions provide the user with the ability to remotely create and manipulate web