TMS zl Module IPS/IDS Signature Reference Guide RLX.10.2.2.94

ProCurve TMS zl Module IPS/IDS Signature
Reference Guide Version RLX.10.2.2.94
865
modules can be used to extend the functionality of the Apache web server. The module mod_tcl 1.0 version is
vulnerable, it allows Apache to run TCL scripts natively. By sending a malformed packet, a remote unauthenticated
attacker may be able to execute arbitrary code with the privileges of the httpd process. Patches are available at apache
website.
Signature ID: 34933
Mozilla Firefox Sidebar Panel Arbitrary Code Execution vulnerability
Threat Level: Warning
Industry ID: CVE-2005-0402
Signature Description: Mozilla Firefox is a web browser descended from the Mozilla Application Suite, managed by
the Mozilla Corporation Firefox before 1.0.2 is vulnerable, it allows remote attackers to execute arbitrary code by
tricking a user into saving a page as a Firefox sidebar panel whenever click to save that particular attacker sent link,
then using the sidebar panel to inject Javascript into a privileged page. Patches are available at mozilla website.
Signature ID: 34935
Java Web Start JNLP File Argument Injection vulnerability
Threat Level: Warning
Industry ID: CVE-2004-1029 Bugtraq: 12317
Signature Description: The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04 and
possibly earlier versions are vulnerable. The vulnerability in the way Sun Java Web Start isolates java applications
from the host system. A Java Web Start configuration file (JNLP) can be crafted to inject command-line arguments into
the vulnerable Web Start virtual machine application. The vulnerable parameter is the value of a JNLP property, load
unsafe classes and execute arbitrary code by using the reflection API to access private Java packages. An attacker can
exploit this vulnerability to bypass security restrictions and perform privileged operations on a target system. The
vulnerable program is javaws.exe in Windows. Patches are available at sun website.
Signature ID: 34936
Microsoft Internet Explorer CSS Memory Corruption vulnerability
Threat Level: Warning
Industry ID: CVE-2004-0842 Bugtraq: 10816
Signature Description: Windows Internet Explorer, commonly abbreviated to IE, is a series of graphical web browsers
developed by Microsoft and included as part of the Microsoft Windows line of operating systems. Cascading Style
Sheets (CSS) is a technology that allows Web authors to have increased control of the design and interaction of their
Web pages. Internet Explorer 6.0 SP1 and earlier versions are vulnerable. The attacker can simply cause a Denial of
Service and crash this vulnerable IE versions by constructing a malicious web page and send it to a victim as an email .
The issue arises when IE is presented a STYLE tag followed by a sequence of comment character /* that is not
terminated, which triggers IE to perform an invalid memory copy operation. Patches are available at microsoft website.
Signature ID: 34938
Cisco IPSec Malformed IKE Packet Vulnerability
Threat Level: Warning
Industry ID: CVE-2004-0710 Bugtraq: 10083
Signature Description: The Cisco IP Security (IPsec) VPN Services Module (VPNSM) is a high-speed module for the
Cisco Catalyst 6500 Series Switch and the Cisco 7600 Series Internet Router that provides integrated IPsec Virtual
Private Network (VPN) services. The Internet Key Exchange (IKE) protocol is an ancillary protocol to IPsec that
facilitates cryptographic key exchange between IPsec-enabled hosts. Vulnerable versions are earlier than
12.2(17b)SXA and earlier than 12.2(17d)SXB. A malformed IKE packet may cause a device with the VPNSM installed
and running these versions of the Cisco IOS software to crash and reload. Patches are available at cisco website.