TMS zl Module IPS/IDS Signature Reference Guide RLX.10.2.2.94

ProCurve TMS zl Module IPS/IDS Signature
Reference Guide Version RLX.10.2.2.94
18
'/iissamples/issamples/' directory), search.idq, query.idq (all in '/iissamples/exair/search/' directory), codebrws.asp (in
'/iissamples/exair/howitworks/' directory),qsumrhit.htw and qfullhit.htw(both in '/iissamples/issamples/oop/' directory).
Signature ID: 107
IIS vulnerable sample files access
Threat Level: Warning
Nessus: 10370
Signature Description: Microsoft IIS is a popular web server package for Windows based platforms. Any web site
running Internet Information Server 3 or 4 with sample IIS files (IDQ - Internet Data Query) is vulnerable. Using these
files it is possible to break outside of the web virtual root and gain unathorized access to files, such as log files and in
certain cases the backup version of the Security Accounts Manager (sam._). The files are author.idq, filesize.idq,
filetime.idq, queryhit.idq and simple.idq (all in '/scripts/samples/search/' directory).
Signature ID: 108
/scripts Directory accessible from external network vulnerability
Threat Level: Warning
Nessus: 10121,10039
Signature Description: IIS '/scripts/ directory is accessible from external network. Microsoft IIS is a popular web server
package for Windows based platforms. The directory '/scripts' is used to store multiple executable scripts used by the
website deployed on IIS. If access is give to view the contents of the folder, an attacker can gain valuable information
about which default scripts or vulnerable custom scripts are installed. No vulnerable scripts should be present in this
directory and the directory permission must be set appropriately.
Signature ID: 110
NT IIS4 /iisadmin Remote Web-Based Administration Vulnerability
Threat Level: Severe
Industry ID: CVE-1999-1538 CVE-2000-0630 Bugtraq: 189 Nessus: 10358
Signature Description: Microsoft IIS is a popular web server package for Windows based platforms. If IIS4.0 was
installed as an upgrade to IIS 2.0 or 3.0, a DLL file (ISM.DLL) is left in the /scripts/iisadmin directory. An attacker
may use this DLL as in 'http://example/scripts/iisadmin/ism.dll?http/dir'. This URL prompts the user for a
username/password to access the remote administration console. Although approved access does not permit the user to
commit changes to the IIS server, it may allow them to gather sensitive information about the web server and its
configuration.
Signature ID: 111
OmniHTTPD imagemap.exe Buffer Overflow Vulnerability
Threat Level: Severe
Industry ID: CVE-1999-0951 Bugtraq: 739 Nessus: 10122
Signature Description: OmniHTTPd is an all-purpose industry compliant web server built specifically for the Windows
95/98/NT4 platform from Omnicron Technologies Corporation. In addition to Standard CGI support, the server sports
features such as Keep-Alive connections, table auto-indexing and server-side includes. Omnicron OmniHTTPD 2.4 Pro
and Omnicron OmniHTTPD 1.1 contain a CGI called 'imagemap.exe' which is vulnerable to a buffer overflow that
allows a remote user to execute arbitrary commands with the privileges of the http server (either nobody or root).
Signature ID: 112
IMP Session Hijacking vulnerability
Threat Level: Warning
Industry ID: CVE-2001-0857 Bugtraq: 3525 Nessus: 10801
Signature Description: Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web