974.txt

This is the snapshot of Snot Latest Rules

Rule:

--
Sid:
974

--
Summary:
This event is generated when an attempt is made to peform a denial of service against Internet Information Service (IIS) 1.0 hosts. 

--
Impact:
Denial of service.  This attack may cause an IIS 1.0 server to crash.

--
Detailed Information:
IIS 1.0 servers are vulnerable to a denial of service attack when a malformed request containing "..\.." is sent to the server.  The service must be restarted to restore functionality.

--
Affected Systems:
IIS 1.0 Servers

--
Attack Scenarios:
An attacker can send a malformed request to a vulnerable IIS server to cause a denial of service. 

--
Ease of Attack:
Simple.  Send a request similar to this:  GET ..\.. 

--
False Positives:
None Known.

--
False Negatives:
None Known.

--
Corrective Action:
Upgrade to a more current version of IIS.
 
--
Contributors:
Original rule writer unknown
Modified by Brian Caswell <[e-mail]>
Sourcefire Vulnerability Research Team
Judy Novak <[e-mail]>

--
Additional References:

--