TMS zl Module IPS/IDS Signature Reference Guide RLX.10.2.2.94

ProCurve TMS zl Module IPS/IDS Signature

Reference Guide Version RLX.10.2.2.94

Signature ID: 7

Alibaba get32.exe Arbitrary Command Execution Vulnerability

Threat Level: Severe

Industry ID: CVE-1999-0885 Bugtraq: 770 Nessus: 10011

Signature Description: A computer program that is responsible for accepting HTTP requests from web clients and

serving them HTTP responses along with optional data contents, which usually are web pages such as HTML

documents and linked objects (images, etc.) is known as a web server. Alibaba Web Server 2.0 contains a flaw that may

allow a remote attacker to execute arbitrary commands. The vulnerability lies in the program 'get32.exe'. This program

does not sanitize user-supplied input. By appending additional commands via a '|' character, arbitrary commands can be

executed under the privileges of the web server.

Signature ID: 8

Alibaba.pl CGI Command Execution Vulnerability

Threat Level: Severe

Industry ID: CVE-1999-0885 CVE-1999-0885 Bugtraq: 770 Nessus: 10013,10011

Signature Description: A computer program that is responsible for accepting HTTP requests from web clients and

serving them HTTP responses along with optional data contents, which usually are web pages such as HTML

documents and linked objects (images, etc.) is known as a web server. Alibaba Web Server 2.0 contains a flaw that may

allow a remote attacker to execute arbitrary commands. The vulnerability lies in the Alibaba.pl cgi. This script does not

sanitize arguments supplied to it. With a specially crafted request, an attacker can provide additional commands that

will be executed.

Signature ID: 9

Alibaba tst.bat CGI Command Execution Vulnerability

Threat Level: Severe

Industry ID: CVE-1999-0885 Bugtraq: 770 Nessus: 10014,10011

Signature Description: A computer program that is responsible for accepting HTTP requests from web clients and

serving them HTTP responses along with optional data contents, which usually are web pages such as HTML

documents and linked objects (images, etc.) is known as a web server. Alibaba Web Server 2.0 contains a flaw that may

allow a remote attacker to execute arbitrary commands. The vulnerability lies in the tst.bat CGI. The script does not

sanitize arguments supplied to it. With a specially crafted request, an attacker can provide additional commands that

will be executed.

Signature ID: 10

Altavista Intranet Search Directory Traversal Vulnerability

Threat Level: Warning

Industry ID: CVE-2000-0039 Bugtraq: 896 Nessus: 10015

Signature Description: A search engine is an information retrieval system designed to help find information stored on a

computer or a network of computers. An intranet is a private computer network that uses Internet protocols and

network connectivity to securely share part of an organization's information or operations with its employees. AltaVista

Intranet Search versions 2.3 A and 2.0b CGI contain a flaw that allows a remote attacker to read arbitrary files outside

of the web path. The issue is due to the "query" not properly sanitizing user input, specifically traversal style attacks

(../../) supplied via the "mss" variable. Due to this vulnerability, it is possible to read the content of any files of the

remote host by making the request : GET /cgi-bin/query?mss=%2e%2e/some_file.