TMS zl Module IPS/IDS Signature Reference Guide RLX.10.2.2.94

ProCurve TMS zl Module IPS/IDS Signature
Reference Guide Version RLX.10.2.2.94
7
database server. Basilix Webmail System version 0.9.7beta is vulnerable to Information Disclosure. If the Web server
is not configured to recognize files with .class or .inc extensions as PHP scripts at the httpd.conf file, a remote attacker
can send an HTTP request to view these files, which may contain sensitive data, such as the MySQL password and
username information. As a workaround, define the .class and .inc file extensions as PHP files, and then deny read
permissions from untrusted users.
Signature ID: 23
Sun's Java Web Serve Bboard Servlet vulnerability
Threat Level: Critical
Industry ID: CVE-2000-0629
Bugtraq: 1459 Nessus: 10507
Signature Description: Sun Java Web Server is a web server designed for medium and large business applications.In un
Java Web Server 2.0 and Sun Java Web Server 1.1.3, the example 'bboard' servlet has a well known security flaw that
lets anyone execute arbitrary commands with the privileges of the http daemon (root or nobody). Therefore access to
this program from outside is suspicious.
Signature ID: 24
Bigconf cgi File View vulnerability
Threat Level: Warning
Industry ID: CVE-1999-1550 Bugtraq: 0778 Nessus: 10027
Signature Description: BigIP is a load balancing system from F5 software. It has a web-based configuration system,
which is vulnerable to several standard CGI attacks. The 'bigconf' cgi has a well known security flaw that lets anyone to
view arbitrary files on the system which it is installed on. F5 BigIP 2.0 is vulnerable.
Signature ID: 25
Bizdb1 search cgi vulnerability
Threat Level: Severe
Industry ID: CVE-2000-0287 Bugtraq: 1104 Nessus: 10383
Signature Description: BizDB is a web database integration product using perl CGI scripts. One of the scripts, bizdb-
search.cgi, passes a variable's contents to an unchecked open() call and can therefore be made to execute commands at
the privilege level of the webserver. The variable is dbname, and if passed a semicolon followed by shell commands
they will be executed. This cannot be exploited from a browser, as the software checks for a referrer field in the HTTP
request. A valid referrer field can however be created and sent programmatically or via a network utility like netcat.
CNC Technology BizDB 1.0 is vulnerable.
Signature ID: 26
Access to Vulnerable Cachemgr CGI
Threat Level: Warning
Industry ID: CVE-1999-0710
Bugtraq: 2059 Nessus: 10034
Signature Description: Squid is a caching proxy for the Web, supporting HTTP, HTTPS, FTP, and more. The
'cachemgr.cgi' module is a management interface for the Squid proxy service. It is installed by default in a public web
directory ('/cgi-bin'), by multiple versions of Red Hat Linux (from 5.2 to FEDORA CORE 3), if the Squid package is
selected during installation. Other flavours of linux including Debian Linux 3.0 also provide the same script if Squid
package is selected during installation. This script prompts for a host and port, which it then tries to connect to. If a
webserver such as Apache is running, this can be used to connect to arbitrary hosts and ports, allowing for potential use
as an intermediary in denial-of-service attacks, proxied port scans, etc. Interpreting the output of the script can allow
the attacker to determine whether or not a connection was established. Therefore, access to this script from outside may
be suspicious and administrator is advised to check the system's log.