NetProwler 3.5.1 Security Update 1

May 8, 2001

NetProwler 3.5.1 Security Update 1

Description

NetProwler 3.5.1 SU1 introduces the following signatures to detect activity of the MStream DDoS (distributed denial-of-service) attack tool. You may obtain NetProwler 3.5.1 SU1 through the product's auto update feature.

Security Update 1 Signatures

MStream_Client

An outgoing MStream DDoS trojan horse client control session has been detected.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2000-0138

MStream_Client_Login

A version of Bootp contains a buffer overflow allowing an attacker to remotely execute arbitrary code.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2000-0138

MStream_Flood

An incoming MStream DDoS TCP flood attack was detected.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2000-0138

MStream_Master_Command

MStream DDoS trojan horse master activity detected (CERT CA-2000-1).

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2000-0138

MStream_Master_Login

MStream DDoS trojan horse master activity detected (CERT CA-2000-1).

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2000-0138

MStream_Master_Newserver

MStream DDoS trojan horse master activity detected (CERT CA-2000-1).

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2000-0138

MStream_Server_Command

MStream DDoS trojan horse server activity detected (CERT CA-2000-1).

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2000-0138

MStream_Server_Newserver

MStream DDoS trojan horse server activity detected (CERT CA-2000-1).

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2000-0138

Last modified on: Thursday, 27-Sep-01 20:59:31