CVE-2010-2024

published 2010-06-07

CVE-2010-2024: transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary…

PriorityP418medium4.4CVSS 2.0

AVLACMAuNCPIPAP

EPSS

0.28%

19.7th percentile

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.

Affected

34 ranges· showing 25

Vendor	Product	Version range	Fixed in
debian	exim4	< exim4 4.72-1 (bookworm)	exim4 4.72-1 (bookworm)
exim	exim	<= 4.71	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—
exim	exim	—	—

CVSS provenance

nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P

osv4.4MEDIUM

vendor_debian4.4LOW

vendor_redhat4.4MEDIUM

vendor_ubuntu4.4MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET WEB_SERVER JBoss jmx-console Access Control Bypass Attempt

suricata·2011-12-10

CVE-2010-0738 ET WEB_SERVER JBoss jmx-console Access Control Bypass Attempt ET WEB_SERVER JBoss jmx-console Access Control Bypass Attempt Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER JBoss jmx-console Access Control Bypass Attempt"; flow:established,to_server; http.method; content:"HEAD"; http.uri; content:"/jmx-console/HtmlAdaptor?"; nocase; content:"Runtime.getRuntime().exec("; reference:cve,2010-0738; classtype:web-application-activity; sid:2014018; rev:4; metadata:created_at 2011_12_10, cve CVE_2010_0738, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_06;)

Suricata

ET WEB_CLIENT Adobe Flash Player Button Remote Code Execution Attempt

suricata·2011-07-15

CVE-2010-3654 ET WEB_CLIENT Adobe Flash Player Button Remote Code Execution Attempt ET WEB_CLIENT Adobe Flash Player Button Remote Code Execution Attempt Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Adobe Flash Player Button Remote Code Execution Attempt"; flow:established,to_client; flowbits:isset,ET.flash.pdf; file.data; content:"|07 07 02 17 07 06 1A 07 1B 1B 07 02 1C 07 07 1E|"; reference:bid,44504; reference:cve,2010-3654; classtype:attempted-user; sid:2013282; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_07_15, cve CVE_2010_3654, deployment Perimeter, confidence High, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_04_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Pu

Suricata

ET NETBIOS Microsoft Windows SMB Client Race Condition Remote Code Execution

suricata·2010-12-22

CVE-2010-0017 ET NETBIOS Microsoft Windows SMB Client Race Condition Remote Code Execution ET NETBIOS Microsoft Windows SMB Client Race Condition Remote Code Execution Rule: alert tcp $EXTERNAL_NET 445 -> $HOME_NET any (msg:"ET NETBIOS Microsoft Windows SMB Client Race Condition Remote Code Execution"; flow:established,to_client; content:"|ff 53 4d 42 72|"; offset:4; depth:5; content:"|00 00 00 00|"; within:4; byte_test:4,<,4356,30,relative,little; reference:url,www.exploit-db.com/exploits/12258/; reference:cve,2010-0017; reference:bid,38100; reference:url,www.microsoft.com/technet/security/Bulletin/MS10-006.mspx; classtype:attempted-user; sid:2012084; rev:4; metadata:created_at 2010_12_22, cve CVE_2010_0017, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_i

Suricata

ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt

suricata·2010-09-29

CVE-2010-1297 ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt"; flow:established,to_client; flowbits:isset,ET.flash.pdf; file.data; content:"|F2 3D 8D 23|"; reference:url,www.exploit-db.com/adobe-acrobat-newclass-invalid-pointer-vulnerability/; reference:cve,2010-1297; classtype:attempted-user; sid:2011519; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_29, cve CVE_2010_1297, deployment Perimeter, confidence Medium, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_04_09, mitre_tactic_id TA0001,

Suricata

GPL WEB_SERVER printenv access

suricata·2010-09-23

CVE-2000-0868 GPL WEB_SERVER printenv access GPL WEB_SERVER printenv access Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SERVER printenv access"; flow:established,to_server; http.uri; content:"/printenv"; reference:bugtraq,1658; reference:cve,2000-0868; reference:nessus,10188; reference:nessus,10503; classtype:web-application-activity; sid:2101877; rev:12; metadata:created_at 2010_09_23, cve CVE_2000_0868, signature_severity Unknown, updated_at 2024_03_08;)

Suricata

GPL FTP DELE overflow attempt

suricata·2010-09-23

CVE-2001-0826 GPL FTP DELE overflow attempt GPL FTP DELE overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP DELE overflow attempt"; flow:established,to_server; content:"DELE"; nocase; isdataat:100,relative; pcre:"/^DELE\s[^\n]{100}/smi"; reference:bugtraq,2972; reference:cve,2001-0826; reference:cve,2001-1021; classtype:attempted-admin; sid:2101975; rev:10; metadata:created_at 2010_09_23, cve CVE_2001_0826, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL SQL sa brute force failed login unicode attempt

suricata·2010-09-23

CVE-2000-1209 GPL SQL sa brute force failed login unicode attempt GPL SQL sa brute force failed login unicode attempt Rule: alert tcp $SQL_SERVERS 1433 -> $EXTERNAL_NET any (msg:"GPL SQL sa brute force failed login unicode attempt"; flow:established,to_client; content:"L|00|o|00|g|00|i|00|n|00| |00|f|00|a|00|i|00|l|00|e|00|d|00| |00|f|00|o|00|r|00| |00|u|00|s|00|e|00|r|00| |00|'|00|s|00|a|00|'|00|"; threshold:type threshold, track by_src, count 5, seconds 2; reference:bugtraq,4797; reference:cve,2000-1209; reference:nessus,10673; classtype:unsuccessful-user; sid:2103273; rev:5; metadata:created_at 2010_09_23, cve CVE_2000_1209, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL FTP CWD overflow attempt

suricata·2010-09-23

CVE-1999-0219 GPL FTP CWD overflow attempt GPL FTP CWD overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP CWD overflow attempt"; flow:established,to_server; content:"CWD"; nocase; isdataat:100,relative; pcre:"/^CWD\s[^\n]{100}/smi"; reference:bugtraq,11069; reference:bugtraq,1227; reference:bugtraq,1690; reference:bugtraq,6869; reference:bugtraq,7251; reference:bugtraq,7950; reference:cve,1999-0219; reference:cve,1999-1058; reference:cve,1999-1510; reference:cve,2000-1035; reference:cve,2000-1194; reference:cve,2001-0781; reference:cve,2002-0126; reference:cve,2002-0405; classtype:attempted-admin; sid:2101919; rev:25; metadata:created_at 2010_09_23, cve CVE_1999_0219, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL FTP SITE overflow attempt

suricata·2010-09-23

CVE-1999-0838 GPL FTP SITE overflow attempt GPL FTP SITE overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE overflow attempt"; flow:established,to_server; content:"SITE"; nocase; isdataat:100,relative; pcre:"/^SITE\s[^\n]{100}/smi"; reference:cve,1999-0838; reference:cve,2001-0755; reference:cve,2001-0770; classtype:attempted-admin; sid:2101529; rev:13; metadata:created_at 2010_09_23, cve CVE_1999_0838, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL SNMP public access tcp

suricata·2010-09-23

CVE-1999-0517 GPL SNMP public access tcp GPL SNMP public access tcp Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"GPL SNMP public access tcp"; flow:established,to_server; content:"public"; reference:bugtraq,2112; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,7212; reference:cve,1999-0517; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:2101412; rev:15; metadata:created_at 2010_09_23, cve CVE_1999_0517, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL EXPLOIT unicode directory traversal attempt

suricata·2010-09-23

CVE-2000-0884 GPL EXPLOIT unicode directory traversal attempt GPL EXPLOIT unicode directory traversal attempt Rule: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"GPL EXPLOIT unicode directory traversal attempt"; flow:established,to_server; content:"/..%c1%1c../"; nocase; reference:bugtraq,1806; reference:cve,2000-0884; reference:nessus,10537; classtype:web-application-attack; sid:2100982; rev:14; metadata:created_at 2010_09_23, cve CVE_2000_0884, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)

Suricata

GPL RPC portmap rusers request TCP

suricata·2010-09-23

CVE-1999-0626 GPL RPC portmap rusers request TCP GPL RPC portmap rusers request TCP Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap rusers request TCP"; flow:established,to_server; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A2|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,133; reference:cve,1999-0626; classtype:rpc-portmap-decode; sid:2101271; rev:16; metadata:created_at 2010_09_23, cve CVE_1999_0626, signature_severity Informational, updated_at 2024_03_08;)

Suricata

GPL POP3 LIST overflow attempt

suricata·2010-09-23

CVE-2000-0096 GPL POP3 LIST overflow attempt GPL POP3 LIST overflow attempt Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"GPL POP3 LIST overflow attempt"; flow:established,to_server; content:"LIST"; nocase; isdataat:10,relative; pcre:"/^LIST\s[^\n]{10}/smi"; reference:bugtraq,948; reference:cve,2000-0096; reference:nessus,10197; classtype:attempted-admin; sid:2101937; rev:9; metadata:created_at 2010_09_23, cve CVE_2000_0096, confidence Medium, signature_severity Major, updated_at 2024_03_08;)

Suricata

GPL FTP MKD overflow attempt

suricata·2010-09-23

CVE-1999-0911 GPL FTP MKD overflow attempt GPL FTP MKD overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP MKD overflow attempt"; flow:established,to_server; content:"MKD"; nocase; isdataat:100,relative; pcre:"/^MKD\s[^\n]{100}/smi"; reference:bugtraq,612; reference:bugtraq,7278; reference:bugtraq,9872; reference:cve,1999-0911; reference:nessus,12108; classtype:attempted-admin; sid:2101973; rev:12; metadata:created_at 2010_09_23, cve CVE_1999_0911, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL POP3 APOP overflow attempt

suricata·2010-09-23

CVE-2000-0840 GPL POP3 APOP overflow attempt GPL POP3 APOP overflow attempt Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"GPL POP3 APOP overflow attempt"; flow:established,to_server; content:"APOP"; nocase; isdataat:256,relative; pcre:"/^APOP\s[^\n]{256}/smi"; reference:bugtraq,1652; reference:cve,2000-0840; reference:cve,2000-0841; reference:nessus,10559; classtype:attempted-admin; sid:2101635; rev:15; metadata:created_at 2010_09_23, cve CVE_2000_0840, confidence Medium, signature_severity Major, updated_at 2024_03_08;)

Suricata

GPL EXPLOIT /iisadmpwd/aexp2.htr access

suricata·2010-09-23

CVE-1999-0407 GPL EXPLOIT /iisadmpwd/aexp2.htr access GPL EXPLOIT /iisadmpwd/aexp2.htr access Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT /iisadmpwd/aexp2.htr access"; flow:established,to_server; http.uri; content:"/iisadmpwd/aexp2.htr"; reference:bugtraq,2110; reference:bugtraq,4236; reference:cve,1999-0407; reference:cve,2002-0421; reference:nessus,10371; classtype:web-application-activity; sid:2101487; rev:14; metadata:created_at 2010_09_23, cve CVE_1999_0407, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL FTP tar parameters

suricata·2010-09-23

CVE-1999-0202 GPL FTP tar parameters GPL FTP tar parameters Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP tar parameters"; flow:established,to_server; content:" --use-compress-program "; nocase; fast_pattern; reference:arachnids,134; reference:bugtraq,2240; reference:cve,1999-0202; reference:cve,1999-0997; classtype:bad-unknown; sid:2100362; rev:16; metadata:created_at 2010_09_23, cve CVE_1999_0202, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL NETBIOS RFParalyze Attempt

suricata·2010-09-23

CVE-2000-0347 GPL NETBIOS RFParalyze Attempt GPL NETBIOS RFParalyze Attempt Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS RFParalyze Attempt"; flow:established,to_server; content:"BEAVIS"; content:"yep yep"; reference:bugtraq,1163; reference:cve,2000-0347; reference:nessus,10392; classtype:attempted-recon; sid:2101239; rev:11; metadata:created_at 2010_09_23, cve CVE_2000_0347, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL WEB_SERVER authors.pwd access

suricata·2010-09-23

CVE-1999-0386 GPL WEB_SERVER authors.pwd access GPL WEB_SERVER authors.pwd access Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SERVER authors.pwd access"; flow:established,to_server; http.uri; content:"/authors.pwd"; nocase; reference:bugtraq,989; reference:cve,1999-0386; reference:nessus,10078; classtype:web-application-activity; sid:2100951; rev:15; metadata:created_at 2010_09_23, cve CVE_1999_0386, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL EXPLOIT fpcount access

suricata·2010-09-23

CVE-1999-1376 GPL EXPLOIT fpcount access GPL EXPLOIT fpcount access Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT fpcount access"; flow:established,to_server; http.uri; content:"/fpcount.exe"; nocase; reference:bugtraq,2252; reference:cve,1999-1376; classtype:web-application-activity; sid:2101013; rev:13; metadata:created_at 2010_09_23, cve CVE_1999_1376, signature_severity Major, updated_at 2024_03_08;)

Suricata

GPL WEB_SERVER Tomcat null byte directory listing attempt

suricata·2010-09-23

CVE-2003-0042 GPL WEB_SERVER Tomcat null byte directory listing attempt GPL WEB_SERVER Tomcat null byte directory listing attempt Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_SERVER Tomcat null byte directory listing attempt"; flow:established,to_server; http.uri; content:"|00|.jsp"; reference:bugtraq,2518; reference:bugtraq,6721; reference:cve,2003-0042; classtype:web-application-attack; sid:2102061; rev:9; metadata:created_at 2010_09_23, cve CVE_2003_0042, signature_severity Unknown, updated_at 2024_03_08;)

Suricata

GPL EXPLOIT ISAPI .ida access

suricata·2010-09-23

CVE-2000-0071 GPL EXPLOIT ISAPI .ida access GPL EXPLOIT ISAPI .ida access Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT ISAPI .ida access"; flow:established,to_server; http.uri; content:".ida"; nocase; endswith; reference:arachnids,552; reference:bugtraq,1065; reference:cve,2000-0071; classtype:web-application-activity; sid:2101242; rev:15; metadata:created_at 2010_09_23, cve CVE_2000_0071, signature_severity Major, updated_at 2024_03_08;)

Suricata

GPL FTP MDTM overflow attempt

suricata·2010-09-23

CVE-2001-1021 GPL FTP MDTM overflow attempt GPL FTP MDTM overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP MDTM overflow attempt"; flow:established,to_server; content:"MDTM"; nocase; isdataat:100,relative; pcre:"/^MDTM\s[^\n]{100}/smi"; reference:bugtraq,9751; reference:cve,2001-1021; reference:cve,2004-0330; reference:nessus,12080; classtype:attempted-admin; sid:2102546; rev:8; metadata:created_at 2010_09_23, cve CVE_2001_1021, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL NETBIOS SMB-DS nddeapi create tree attempt

suricata·2010-09-23

CVE-2004-0206 GPL NETBIOS SMB-DS nddeapi create tree attempt GPL NETBIOS SMB-DS nddeapi create tree attempt Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS nddeapi create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; flowbits:set,smb.tree.create.nddeapi; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"|5C|nddeapi|00|"; within:9; distance:78; nocase; reference:bugtraq,11372; reference:cve,2004-0206; classtype:protocol-command-decode; sid:2102930; rev:6; metadata:created_at 2010_09_23, cve CVE_2004_0206, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_14;)

Suricata

GPL EXPLOIT Alternate Data streams ASP file access attempt

suricata·2010-09-23

CVE-1999-0278 GPL EXPLOIT Alternate Data streams ASP file access attempt GPL EXPLOIT Alternate Data streams ASP file access attempt Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT Alternate Data streams ASP file access attempt"; flow:established,to_server; http.uri; content:".asp|3A 3A 24|DATA"; nocase; reference:bugtraq,149; reference:cve,1999-0278; reference:nessus,10362; reference:url,support.microsoft.com/default.aspx?scid=kb#-#-EN-US#-#-q188806; classtype:web-application-attack; sid:2100975; rev:16; metadata:created_at 2010_09_23, signature_severity Major, updated_at 2024_03_08;)

Suricata

GPL EXPLOIT unicode directory traversal attempt

suricata·2010-09-23

CVE-2000-0884 GPL EXPLOIT unicode directory traversal attempt GPL EXPLOIT unicode directory traversal attempt Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT unicode directory traversal attempt"; flow:established,to_server; http.uri.raw; content:"/..%c0%af../"; nocase; reference:bugtraq,1806; reference:cve,2000-0884; reference:nessus,10537; classtype:web-application-attack; sid:2100981; rev:17; metadata:created_at 2010_09_23, cve CVE_2000_0884, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)

Suricata

GPL WEB_SERVER apache ?M=D directory list attempt

suricata·2010-09-23

CVE-2001-0731 GPL WEB_SERVER apache ?M=D directory list attempt GPL WEB_SERVER apache ?M=D directory list attempt Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SERVER apache ?M=D directory list attempt"; flow:established,to_server; http.uri; content:"/?M=D"; reference:bugtraq,3009; reference:cve,2001-0731; classtype:web-application-activity; sid:2101519; rev:13; metadata:created_at 2010_09_23, cve CVE_2001_0731, signature_severity Unknown, updated_at 2024_03_08;)

Suricata

GPL FTP APPE overflow attempt

suricata·2010-09-23

CVE-2000-0133 GPL FTP APPE overflow attempt GPL FTP APPE overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP APPE overflow attempt"; flow:established,to_server; content:"APPE"; nocase; isdataat:100,relative; pcre:"/^APPE\s[^\n]{100}/smi"; reference:bugtraq,8315; reference:bugtraq,8542; reference:cve,2000-0133; reference:cve,2003-0466; classtype:attempted-admin; sid:2102391; rev:12; metadata:created_at 2010_09_23, cve CVE_2000_0133, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL INFO Sun JavaServer default password login attempt

suricata·2010-09-23

CVE-1999-0508 GPL INFO Sun JavaServer default password login attempt GPL INFO Sun JavaServer default password login attempt Rule: alert http $EXTERNAL_NET any -> $HOME_NET 9090 (msg:"GPL INFO Sun JavaServer default password login attempt"; flow:established,to_server; content:"ae9f86d6beaa3f9ecb9a5b7e072a4138"; http.uri; content:"/servlet/admin"; reference:cve,1999-0508; reference:nessus,10995; classtype:default-login-attempt; sid:2101859; rev:9; metadata:created_at 2010_09_23, cve CVE_1999_0508, confidence Medium, signature_severity Informational, updated_at 2024_03_08;)

Suricata

GPL NETBIOS SMB-DS DCERPC LSASS direct bind attempt

suricata·2010-09-23

CVE-2003-0533 GPL NETBIOS SMB-DS DCERPC LSASS direct bind attempt GPL NETBIOS SMB-DS DCERPC LSASS direct bind attempt Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS DCERPC LSASS direct bind attempt"; flow:established,to_server; flowbits:set,netbios.lsass.bind.attempt; flowbits:noalert; content:"|00|"; depth:1; content:"|FF|SMB"; depth:4; offset:4; nocase; content:"|05|"; content:"|0B|"; within:1; distance:1; content:"j|28 19|9|0C B1 D0 11 9B A8 00 C0|O|D9|.|F5|"; within:16; distance:29; reference:bugtraq,10108; reference:cve,2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:protocol-command-decode; sid:2102526; rev:9; metadata:created_at 2010_09_23, cve CVE_2003_0533, confidence Medium, signature_severity Informational, updated_at 2024_03_14;)

Suricata

GPL RPC portmap espd request TCP

suricata·2010-09-23

CVE-2001-0331 GPL RPC portmap espd request TCP GPL RPC portmap espd request TCP Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap espd request TCP"; flow:established,to_server; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 05 F7|u"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,2714; reference:cve,2001-0331; classtype:rpc-portmap-decode; sid:2100595; rev:18; metadata:created_at 2010_09_23, cve CVE_2001_0331, signature_severity Informational, updated_at 2024_03_08;)

Suricata

GPL FTP SITE EXEC attempt

suricata·2010-09-23

CVE-1999-0080 GPL FTP SITE EXEC attempt GPL FTP SITE EXEC attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE EXEC attempt"; flow:established,to_server; content:"SITE"; nocase; content:"EXEC"; distance:0; nocase; pcre:"/^SITE\s+EXEC/smi"; reference:arachnids,317; reference:bugtraq,2241; reference:cve,1999-0080; reference:cve,1999-0955; classtype:bad-unknown; sid:2100361; rev:18; metadata:created_at 2010_09_23, cve CVE_1999_0080, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL SQL sa brute force failed login attempt

suricata·2010-09-23

CVE-2000-1209 GPL SQL sa brute force failed login attempt GPL SQL sa brute force failed login attempt Rule: alert tcp $SQL_SERVERS 1433 -> $EXTERNAL_NET any (msg:"GPL SQL sa brute force failed login attempt"; flow:established,to_client; content:"Login failed for user 'sa'"; threshold:type threshold, track by_src, count 5, seconds 2; reference:bugtraq,4797; reference:cve,2000-1209; reference:nessus,10673; classtype:unsuccessful-user; sid:2103152; rev:5; metadata:created_at 2010_09_23, cve CVE_2000_1209, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL FTP SITE NEWER overflow attempt

suricata·2010-09-23

CVE-1999-0800 GPL FTP SITE NEWER overflow attempt GPL FTP SITE NEWER overflow attempt Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP SITE NEWER overflow attempt"; flow:established,to_server; content:"SITE"; nocase; content:"NEWER"; distance:0; nocase; isdataat:100,relative; pcre:"/^SITE\s+NEWER\s[^\n]{100}/smi"; reference:bugtraq,229; reference:cve,1999-0800; classtype:attempted-admin; sid:2101920; rev:9; metadata:created_at 2010_09_23, cve CVE_1999_0800, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL NETBIOS xp_reg* - registry access

suricata·2010-09-23

CVE-2002-0642 GPL NETBIOS xp_reg* - registry access GPL NETBIOS xp_reg* - registry access Rule: alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"GPL NETBIOS xp_reg* - registry access"; flow:established,to_server; content:"x|00|p|00|_|00|r|00|e|00|g|00|"; nocase; reference:bugtraq,5205; reference:cve,2002-0642; reference:nessus,10642; reference:url,www.microsoft.com/technet/security/bulletin/MS02-034; classtype:attempted-user; sid:2100686; rev:12; metadata:created_at 2010_09_23, cve CVE_2002_0642, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL POP3 AUTH overflow attempt

suricata·2010-09-23

CVE-1999-0822 GPL POP3 AUTH overflow attempt GPL POP3 AUTH overflow attempt Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"GPL POP3 AUTH overflow attempt"; flow:established,to_server; content:"AUTH"; nocase; isdataat:50,relative; pcre:"/^AUTH\s[^\n]{50}/smi"; reference:bugtraq,830; reference:cve,1999-0822; reference:nessus,10184; classtype:attempted-admin; sid:2101936; rev:10; metadata:created_at 2010_09_23, cve CVE_1999_0822, confidence Medium, signature_severity Major, updated_at 2024_03_08;)

Suricata

GPL NETBIOS DCERPC Workstation Service direct service bind attempt

suricata·2010-09-23

CVE-2003-0812 GPL NETBIOS DCERPC Workstation Service direct service bind attempt GPL NETBIOS DCERPC Workstation Service direct service bind attempt Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"GPL NETBIOS DCERPC Workstation Service direct service bind attempt"; flow:established,to_server; content:"|05 00 0B|"; depth:3; byte_test:1,&,16,1,relative; content:"|98 D0 FF|k|12 A1 10|6|98|3F|C3 F8|~4Z"; within:16; distance:29; reference:bugtraq,9011; reference:cve,2003-0812; reference:url,www.microsoft.com/technet/security/bulletin/MS03-049.mspx; classtype:misc-attack; sid:2102315; rev:8; metadata:created_at 2010_09_23, cve CVE_2003_0812, signature_severity Informational, updated_at 2024_03_08;)

Suricata

GPL WEB_SERVER global.asa access

suricata·2010-09-23

CVE-2000-0778 GPL WEB_SERVER global.asa access GPL WEB_SERVER global.asa access Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SERVER global.asa access"; flow:established,to_server; http.uri; content:"/global.asa"; nocase; reference:cve,2000-0778; reference:nessus,10491; reference:nessus,10991; classtype:web-application-activity; sid:2101016; rev:17; metadata:created_at 2010_09_23, cve CVE_2000_0778, signature_severity Unknown, updated_at 2024_03_08;)

Suricata

GPL EXPLOIT NTLM ASN.1 vulnerability scan attempt

suricata·2010-09-23

CVE-2003-0818 GPL EXPLOIT NTLM ASN.1 vulnerability scan attempt GPL EXPLOIT NTLM ASN.1 vulnerability scan attempt Rule: alert http1 $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL EXPLOIT NTLM ASN.1 vulnerability scan attempt"; flow:established,to_server; http.header; content:"Authorization|3A| Negotiate YIQAAABiBoMAAAYrBgEFBQKgggBTMIFQoA4wDAYKKwYBBAGCNwICCqM"; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12055; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:attempted-dos; sid:2102386; rev:14; metadata:created_at 2010_09_23, cve CVE_2003_0818, signature_severity Major, updated_at 2024_04_03;)

Suricata

ET WEB_SPECIFIC_APPS Experts answer.php question_id parameter SQL Injection

suricata·2010-07-30

CVE-2008-5267 ET WEB_SPECIFIC_APPS Experts answer.php question_id parameter SQL Injection ET WEB_SPECIFIC_APPS Experts answer.php question_id parameter SQL Injection Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Experts answer.php question_id parameter SQL Injection"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/answer.php?"; nocase; content:"question_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,2008-5267; reference:url,milw0rm.com/exploits/5776; reference:bugtraq,29642; classtype:web-application-attack; sid:2008931; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, cve CVE_2008_5267, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2024_03_06, mitre_tactic_id TA0001, mitre_tacti

Suricata

ET WEB_SPECIFIC_APPS OTManager ADM_Pagina.php Tipo Remote File Inclusion

suricata·2010-07-30·CVSS 10.0

CVE-2008-5063 [CRITICAL] ET WEB_SPECIFIC_APPS OTManager ADM_Pagina.php Tipo Remote File Inclusion ET WEB_SPECIFIC_APPS OTManager ADM_Pagina.php Tipo Remote File Inclusion Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS OTManager ADM_Pagina.php Tipo Remote File Inclusion"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/ADM_Pagina.php?"; nocase; content:"Tipo="; nocase; pcre:"/Tipo=\s*(?:https?|ftps?|php)\:\//i"; reference:cve,CVE-2008-5063; reference:url,vupen.com/english/advisories/2008/3093; reference:url,secunia.com/advisories/32645; classtype:web-application-attack; sid:2009395; rev:7; metadata:created_at 2010_07_30, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Expl

Suricata

ET WEB_SPECIFIC_APPS Hedgehog CMS footer.php c_temp_path Remote File Inclusion

suricata·2010-07-30·CVSS 9.3

CVE-2008-2898 [CRITICAL] ET WEB_SPECIFIC_APPS Hedgehog CMS footer.php c_temp_path Remote File Inclusion ET WEB_SPECIFIC_APPS Hedgehog CMS footer.php c_temp_path Remote File Inclusion Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Hedgehog CMS footer.php c_temp_path Remote File Inclusion"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/includes/footer.php?"; nocase; content:"c_temp_path"; nocase; pcre:"/c_temp_path=\s*(https?|ftps?|php)\:\//i"; reference:cve,CVE-2008-2898; reference:url,secunia.com/advisories/30778/; reference:url,milw0rm.com/exploits/8028; classtype:web-application-attack; sid:2009232; rev:8; metadata:created_at 2010_07_30, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_tec

Suricata

ET SNMP Attempted TCP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String cable-docsis

suricata·2010-07-30

CVE-2004-1776 ET SNMP Attempted TCP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String cable-docsis ET SNMP Attempted TCP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String cable-docsis Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"ET SNMP Attempted TCP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String cable-docsis"; flow:established,to_server; content:"cable-docsis"; nocase; reference:url,www.cisco.com/warp/public/707/cisco-sa-20010228-ios-snmp-community.shtml; reference:url,www.iss.net/security_center/reference/vuln/cisco-ios-cable-docsis.htm; reference:url,www.kb.cert.org/vuls/id/840665; reference:cve,2004-1776; classtype:attempted-admin; sid:2011014; rev:3; metadata:created_at 2010_07_30, cve CVE_2004_1776, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_06;)

Suricata

ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=)

suricata·2010-07-30

CVE-2002-0953 ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=) ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=) Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=)"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:".php?"; nocase; content:"cmd="; fast_pattern; nocase; pcre:"/[&?]cmd=[^\x26\x28]*(?:cd|\;|echo|cat|perl|curl|wget|id|uname|t?ftp)/i"; reference:cve,2002-0953; classtype:web-application-attack; sid:2010920; rev:10; metadata:created_at 2010_07_30, cve CVE_2002_0953, confidence Medium, signature_severity Major, updated_at 2024_01_03;)

Suricata

ET WEB_SPECIFIC_APPS Hedgehog CMS header.php c_temp_path Remote File Inclusion

suricata·2010-07-30·CVSS 9.3

CVE-2008-2898 [CRITICAL] ET WEB_SPECIFIC_APPS Hedgehog CMS header.php c_temp_path Remote File Inclusion ET WEB_SPECIFIC_APPS Hedgehog CMS header.php c_temp_path Remote File Inclusion Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Hedgehog CMS header.php c_temp_path Remote File Inclusion"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/includes/header.php?"; nocase; content:"c_temp_path"; nocase; pcre:"/c_temp_path=\s*(https?|ftps?|php)\:\//i"; reference:cve,CVE-2008-2898; reference:url,secunia.com/advisories/30778/; reference:url,milw0rm.com/exploits/5904; classtype:web-application-attack; sid:2009233; rev:8; metadata:created_at 2010_07_30, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_tec

Suricata

ET WEB_SERVER HP OpenView Network Node Manager CGI Directory Traversal

suricata·2010-07-30·CVSS 5.0

CVE-2008-0068 [MEDIUM] ET WEB_SERVER HP OpenView Network Node Manager CGI Directory Traversal ET WEB_SERVER HP OpenView Network Node Manager CGI Directory Traversal Rule: alert http1 $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER HP OpenView Network Node Manager CGI Directory Traversal"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/OvCgi/"; nocase; content:"/OpenView5.exe?"; nocase; distance:0; fast_pattern; content:"Action=../../"; nocase; distance:0; http.protocol; content:"HTTP/1."; reference:bugtraq,28745; reference:cve,CVE-2008-0068; reference:url,aluigi.altervista.org/adv/closedviewx-adv.txt; classtype:web-application-attack; sid:2008171; rev:15; metadata:created_at 2010_07_30, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discov