TMS zl Module IPS/IDS Signature Reference Guide RLX.10.2.2.94

ProCurve TMS zl Module IPS/IDS Signature
Reference Guide Version RLX.10.2.2.94
574
Signature ID: 21116
MS SQL Server xp_proxiedmetadata Buffer Overflow Vulnerability
Threat Level: Information
Industry ID: CVE-2000-1087 Bugtraq: 2042
Signature Description: The xp_proxiedmetadata function in Microsoft SQL Server 2000 and SQL Server Desktop
Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL
Server API for Extended Stored Procedures (XP). This allows an attacker to cause a denial of service or execute
arbitrary commands. This rule triggers when a call is made to 'xp_proxiedmetadata'.
Signature ID: 21117
MS SQL Server xp_peekqueue Buffer Overflow Vulnerability
Threat Level: Warning
Industry ID: CVE-2000-1085 CVE-2001-0066 Bugtraq: 2040,2004
Signature Description: Microsoft SQL Server is a database platform for use on hosts using the Microsoft Windows
operating system. A vulnerability in handling of srv_paraminfo() function, which does not check the length of the
parameter string that an XP passes to it. Therefore the Extended Stored Procedures API may allow an attacker to
overflow a fixed length buffer and execute code of their choosing on an affected host. A DoS condition may also result
due to the server failing to handle a memory copy routine properly which may cause the server to crash. This rule will
trigger, when an attempt is made to exploit the function "xp_peekqueue".
Signature ID: 21118
MS SQL Server xp_showcolv Buffer Overflow Vulnerability
Threat Level: Information
Industry ID: CVE-2000-1083 Bugtraq: 2038
Signature Description: The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE)
does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for
Extended Stored Procedures (XP). This allows an attacker to cause a denial of service or execute arbitrary commands.
his rule triggers when a call is made to 'xp_showcolv'.
Signature ID: 21119
MS-SQL/SMB Shellcode Attempt (1)
Threat Level: Warning
Signature Description: Attackers may include shell code in SQL/SMB queries that exploits the target servers. This rule
detects any NOP sequence, generally used in shellcode in the SQL/SMB traffic.
Signature ID: 21120
MS SQL Server/SMB xp_sprintf Buffer Overflow Vulnerability
Threat Level: Information
Signature Description: The xp_sprintf function in Microsoft SQL Server 2000 and SQL Server Desktop Engine
(MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server
API for Extended Stored Procedures (XP). This allows an attacker to cause a denial of service or execute arbitrary
commands. This rule triggers when a call is made to 'xp_sprintf'.
Signature ID: 21121
MS-SQL Shellcode Attempt
Threat Level: Warning
Signature Description: Attackers can include shell code in the traffic to exploit the vulnerabilities in MS-SQL servers.
This rule detects if there is a NOP sequence in the traffic targetted to MS-SQL servers.<br>