TMS zl Module IPS/IDS Signature Reference Guide RLX.10.2.2.94

ProCurve TMS zl Module IPS/IDS Signature

Reference Guide Version RLX.10.2.2.94

switch crashes and performs a software to re-load and network connectivity is disrupted. By repeatly sending such

HTTP requests, a denial of service attack can be performed against the switch and the entire network connected to

it.Cisco Internetwork Operating System Software IOS (tm), C2900XL Software (C2900XL-H2S-M), Version

12.0(5.1)XP is vulnerable platform.

Signature ID: 414

Cisco 675 DSL Router DoS Vulnerability

Threat Level: Warning

Industry ID: CVE-2001-0058 Nessus: 10561

Signature Description: Cisco Broadband Operating System is the operating system for Cisco 600 series routers.The

Cisco 600 series routerd are small office/home office (SOHO)/telecommuter DSL routers. The Web interface to Cisco

600 series routers running CBOS 2.4.1 and earlier allow remote attackers to cause a denial of service via a URL that

does not end in a space character. It is possible to lock the remote server by doing the request : GET ? \r\n\r\n. The

administrator needs to reboot it to make it work again. A cracker may use this flaw to crash this host, thus preventing

your network from working properly.

Signature ID: 415

Domino HTTP Denial of Service by sending long URL vulnerability

Threat Level: Severe

Industry ID: CVE-2000-0023 Bugtraq: 0881 Nessus: 10059,10406

Signature Description: Lotus Domino HTTP server can be used as a traditional Web server, with static html documents

and cgi-bin scripts handling. These features are turned on by default, and use /cgi-bin virtual path, mapped to

<NOTESDATA>\domino\cgi-bin directory.It contains a flaw that may allow a remote denial of service. The issue is

triggered when a very long URL is called in the /cgi-bin directory for a non-existent page, and will result in loss of

availability for the platform. Lotus Domino Server 4.6 .x, Microsoft Windows NT 4.0 are vulnerable platform.

Signature ID: 416

Eicon DivaLAN ISDN modem DoS vulnerability

Threat Level: Warning

Industry ID: CVE-1999-1533 Bugtraq: 665 Nessus: 10062

Signature Description: Eicon Technology Corporation sells a variety of products that provide connectivity. One of

these products is an ISDN modem (called DIVA ISDN modem). This modem was found to be vulnerable to a remote

Denial of Service attack, which renders it useless (when it is attacked) until a hard reset is done to the device. With the

default configuration, only users from the local network can perform this attack. This vulnerability has been fixed by

the vendor and a new firmware is available. This attack will send the GET request with the uri

/login.htm?password=AA[....]AAA This A will Repeats 200 times. Diva LAN ISDN Modem 1.0 release 2.5 is affected

by this vulnerability.

Signature ID: 417

SalesLogix Eviewer WebApplication admin access vulnerability

Threat Level: Warning

Industry ID: CVE-2000-0278 Bugtraq: 1089 Nessus: 10361

Signature Description: The SalesLogix eViewer is Web-based application that provides a Web interface for use with

SalesLogix data. eViewer will not perform authorization on administrative commands if they are requested directly in

the URL. As an example, it is possible to crash the remote server by requesting, GET

/scripts/slxweb.dll/admin?command=shutdown, A hacker may use this flaw to issue admin commands without any

authentication. SalesLogix Corporation eViewer 1.0 is vulnerable to this issue.