SID 1:964

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER Microsoft Frontpage users.pwd access

Rule Explanation

This event is generated when an attempt is made to exploit a known vulnerability in a web server running Microsoft FrontPage Server Extensions. Impact: Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases. Denial of Service is possible. Details: This event is generated when an attempt is made to compromise a host running Microsoft FrontPage Server Extensions. Many known vulnerabilities exist for this platform and the attack scenarios are legion. This event is generated when an attempt is made to retrieve the file users.pwd. This file contains user password information. Ease of Attack: Simple. Many exploits exist.

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Brian Caswell Nigel Houghton