TMS zl Module IPS/IDS Signature Reference Guide RLX.10.2.2.94

ProCurve TMS zl Module IPS/IDS Signature
Reference Guide Version RLX.10.2.2.94
27
program allows remote attackers to read arbitrary files via a .. (dot dot) charecter sequence and to execute arbitrary
commands via shell meta characters in the documentName parameter.
Signature ID: 155
PCCS-Mysql User/Password Exposure vulnerability
Threat Level: Warning
Industry ID: CVE-2000-0707 Bugtraq: 1557 Nessus: 10783
Signature Description: PCCS-Mysql Database Admin Tool is a web-based front end to MySQL written in PHP. PCCS
MySQLDatabase Admin Tool Manager 1.2.4 and earlier install the file dbconnect.inc within the web root, which
allows remote attackers to obtain sensitive information, such as the username and password used to connect to the
database, if it is requested via http by an attacker as demostrated in
'http://your_site.com/pccsmysqladm/incs/dbconnect.inc'.
Signature ID: 156
ActivePerl perlIS.dll Buffer Overflow vulnerability
Threat Level: Warning
Industry ID: CVE-2001-0815 Bugtraq: 3526 Nessus: 10811
Signature Description: ActivePerl is an implementation of the Perl scripting language for Microsoft Windows systems
developed by Activestate. ActivePerl allows for high-performance integration with IIS using a DLL called 'perlIIS.dll'
to handle a '.plx' ISAPI extension. Buffer overflow in PerlIS.dll in Activestate ActivePerl 5.6.1.629 and earlier allows
remote attackers to exute arbitrary code via an HTTP request for a long filename(greater than 350 bytes)that ends in a
.pl extension due to an unbounded string copy operation.
Signature ID: 157
Perl http Directory Disclosure Vulnerability
Threat Level: Warning
Industry ID: CVE-2000-0883 Bugtraq: 1678 Nessus: 10511
Signature Description: Mandrake Linux is a Linux distribution created by Mandrakesoft. It uses the RPM Package
Manager. The default configuration files for versions of mod_perl shipped with Mandrake Linux 6.1 through 7.1
contain a misconfiguration : The request to list /perl directory is allowed on the webserver as it is within webroot and
permitted. Hence, an attacker can see the listing of the files present in /perl. As a result of this information, an attacker
can target the scripts that are known to be vulnerable and are available in this directory.
Signature ID: 158
PerlCal Directory Traversal Vulnerability
Threat Level: Severe
Industry ID: CVE-2001-0463 Bugtraq: 2663 Nessus: 10664
Signature Description: PerlCal is a CGI script written by Acme Software that allows web-based calendar sharing and
related functions. Acme Software PerlCal 2.3 thorugh 2.95 allow remote user to traverse the filesystem of a target host
through the use of double dot '../' character sequence in the p0 parameter. This attack may lead to the disclosure of
sensitive information and may be of assistance in further attacks.
Signature ID: 159
Perl interpreter can be launched as a CGI vulnerability
Threat Level: Severe
Industry ID: CVE-1999-0509 Nessus: 10173
Signature Description: Perl.exe is accessible from web server. The Common Gateway Interface (CGI) is a standard
protocol for interfacing external application software with a web server. To execute CGI scripts, a Web server must be
able to access the interpreter used for that script. In all web servers, there is a directory dedicated to such applications