1817.txt

来自「snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具」· 文本 代码 · 共 59 行

Rule:

--
Sid:
1817

--
Summary:
This event is generated when an attempt is made to log on to Microsoft Site Server with a default account. 

--
Impact:
Information gathering.  This attack may permit leaking of information associated with particular Site Server files.

--
Detailed Information:
Microsoft Site Server is software for Windows NT servers that allows users to publish, find, and share information.  There is a vulnerability that allows leaking of information of some Site Server files when an attacker logs on with the username of 'LDAP_AnonymousUser' and a password of 'LdapPassword_1'.

--
Affected Systems:

Microsoft Site Server 3.0 

--
Attack Scenarios:
An attacker can log on to Site Server using a default username and password to view Site Server files.

--
Ease of Attack:
Simple.

--
False Positives:
None Known.

--
False Negatives:
None Known.

--
Corrective Action:
Apply Service Pack 4.


--
Contributors:
Original rute writer unknown
Modified by Brian Caswell <[e-mail]>
Sourcefire Research Team
Judy Novak <[e-mail]>

--
Additional References:

Nessus
http://cgi.nessus.org/plugins/dump.php3?id=11018

--