NetProwler 3.5.1 SU7 introduces signatures that detect conflicting TCP flags, FrontPage path disclosure, buffer overflows style attacks for FTP, Solaris snmpXdmid, print spooler, and statd services. It also strengthens the already existing NetProwler Girlfriend, CodeBrws_CGI, Perl_CGI, URL_Directory_Traversal, and URL_Hex_Characters signatures. This update contains eighteen new signatures. You may obtain NetProwler 3.5.1 SU7 through the product's auto update feature.
- DNS_NXT_BufferOverflow
Detects the attempt to obtain root through DNS using invalid NXT Records.
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=1999-0833
- Icmp_Mask_Request
Detects the attempts to obtain subnet mask information.
- Icmp_Time_Request
Detects the attempts to obtain system time information.
- Linux_LPRng_Root
Detects the attempt to obtain root through the Berkeley LPR print spooler. This exploit is considered to be part of the Ramen and ADORE Internet Worms.
http://www.securityfocus.com/bid/1712
- Linux_Statd_Root
Detects the attempt to obtain root through rpc.statd.
- Tcp_Syn_Fin
A TCP packet containing conflicting flags can be used to identify IP implementations, or potentially as a denial of service.
- Tcp_Xmas_Scan
A TCP packet containing conflicting flags can be used to identify IP implementations, or potentially as a denial of service.
- WUFTP_Printf_Root
Detects the attempt to obtain root through FTP SITE EXEC Commands.
Last modified on: Wednesday, 06-Feb-02 16:44:18
|
