2091.txt

This is the snapshot of Snot Latest Rules

Rule:

--
Sid:
2091

--
Summary:
This event is generated when an attempt is made to exploit a known vulnerability in Microsoft Internet Information Server is detected.

--
Impact:
Information disclosure.

--
Detailed Information:
A vulnerability exists in a component used by the Microsoft Internet Information Server 5.0 implementation of WebDAV. A specially crafted overly long URI when processed by the server, triggers a buffer overflow in ntdll.dll which results in a system compromise of the targeted host.

The exploit only affects versions of IIS 5.0 running on Microsoft Windows 2000 prior to service pack 3. WebDAV is enabled by default on that platform.

This event may also be generated when a scan for vulnerabilities using the security scanner nessus is attempted.

--
Affected Systems:
Microsoft Internet Information Server 5.0 WebDAV on Windows 2000 prior to Service Pack 3.

--
Attack Scenarios:
The attacker is using nessus.

--
Ease of Attack:
Simple

--
False Positives:
None Known

--
False Negatives:
None Known

--
Corrective Action:
Apply the appropriate vendor supplied patch or service pack.

--
Contributors:
Sourcefire Vulnerability Research Team
Brian Caswell <[e-mail]>
Nigel Houghton <[e-mail]>

--
Additional References:

Microsoft:
http://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Gaobot
http://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Nachi
http://www.microsoft.com/security/encyclopedia/details.aspx?name=win32/rbot
http://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Sdbot

Nessus:
http://cgi.nessus.org/plugins/dump.php3?id=11412

CERT:
http://www.cert.org/advisories/CA-2003-09.html

CVE:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0109

Microsoft Corporation:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-007.asp
http://www.microsoft.com/security/security_bulletins/ms03-007.asp

--