1661.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule:

--
Sid:
1661

--
Summary:
This event is generated when an attempt is made to access the cmd32.exe file.

--
Impact:
Remote access. This attack may permit the execution of arbitrary commands on the vulnerable server. 

--
Detailed Information:
The cmd32.exe file allows execution of commands on Windows hosts.  This file is only accessible if maliciously placed in the web server's root directory or an attacker performs unauthorized directory traversal.  This may permit the attacker to execute arbitrary commands on the vulnerable server.

--
Affected Systems:
???

--
Attack Scenarios:
An attacker can attempt to access the cmd32.exe file to execute arbitrary commands on the vulernable server. 

--
Ease of Attack:
Simple.

--
False Positives:
None Known.

--
False Negatives:
None Known.

--
Corrective Action:
Make sure that the cmd32.exe is not in the webroot directory.

Make sure that all appropriate patches have been applied.

--
Contributors:
Original rule writer unknown
Modified by Brian Caswell <[e-mail]>
Sourcefire Research Team
Judy Novak <[e-mail]>

--
Additional References:

--