1809.txt

This is the snapshot of Snot Latest Rules

Rule:

--
Sid:
1809

--
Summary:
This event is generated when an attempt is made to infect a web server by the "Scalper" worm.

--
Impact:
An infected server will open ports and listen for commands as well as 
attempt to infect more systems.

--
Detailed Information:
This worm takes advantage of the chunked encoding vulnerability in 
Apache to infect new systems. Once infected, the worm opens UDP port 
2001 and will listen for additional commands. It will also begin 
scanning for new hosts to infect.

--
Affected Systems:
Version of Apache 1.3 up to and including 1.3.24 and versions of Apache 
2.0 up to 2.0.36. All versions of Apache 1.2 are vulnerable. This worm 
will only infect systems running FreeBSD.

--
Attack Scenarios:
Typical self-replicating worm.

--
Ease of Attack:
Simple. This is worm activity and is fully automated.

--
False Positives:
None Known.

--
False Negatives:
None known.

--
Corrective Action:
Upgrade your installation of Apache if you are running a vulnerable 
version.

--
Contributors:
Sourcefire Vulnerability Research Team
Brian Caswell <[e-mail]>
Snort documentation contributed by Kevin Peuhkurinen

-- 
Additional References:

Symantec
http://securityresponse.symantec.com/avcenter/venc/data/freebsd.scalper.worm.html

--