NetProwler 3.5.1 Security Update 10

October 5, 2001
NetProwler 3.5.1 Security Update 10

Description

NetProwler 3.5.1 SU10 introduces signatures that detect various buffer overflow and denial of service attacks. It also adds two new signatures that detect attacks to various CGI programs. This update contains eight new signatures, and one updated signature. You may obtain NetProwler 3.5.1 SU10 through the product's auto update feature.

Security Update 10 Signatures

DNS_ZoneTransfer_Query

Unauthorized zone transfers allow attackers to obtain a complete list of hosts in a domain.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=1999-0532

HTTP_FaxSurvey_CGI

Some versions of Hylafax FaxSurvey CGI program allow remote command execution with the privileges of the web server process.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=1999-0262

IIS_CGI_Decode_Command_Execution

Certain versions of IIS allow remote attackers to escape bounding directories by using an HTML string replacement.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2001-0333

NETBIOS_Flood

This signature detects a high rate of NetBIOS connections to port 139.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2000-1039

NETBIOS_WIN9X_Password_Extractor

This signature detects attempts to circumvent the password protection scheme in Window 9x.

. http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=1999-0518

Rapid_ARP_Retries

Multiple ARP requests in quick succession can be sent to the same target to overload the Windows Address Resolution Protocol lookup table and deny service to the affected server.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2000-0444

RPC_CMSD_Buffer_Overflow

This signature detects an attempt to overflow an rpc.cmsd buffer and execute arbitrary commands.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=1999-0696

Rpcttdbserver_Remote_Kill

This signature detects attempts to overflow a buffer in rpc.ttdbserverd resulting in denial of service on certain versions of Solaris, IRIX and HP-UX.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=1999-0003

Telnetd_AYT_Buffer_Overflow

This signature detects attempts to overflow a buffer in telnetd using multiple AYT commands.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2001-0554

Last modified on: Tuesday, 11-Jun-02 18:52:06