1826.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule:

--
Sid:
1826

--
Summary:
This event is generated when an attempt is made to access the WEB-INF
directory on a web server.

--
Impact:
Information disclosure.

--
Detailed Information:
This event is generated when an attempt is made to access the WEB-INF
directory on a web server.

Multiple vendors are affected by an information disclosure issue where
sensitive contents of a web application server can be revealed to an
attacker by requesting the contents of this directory.

--
Affected Systems:
	Multiple vendors, see references.

--
Attack Scenarios:
The attacker can make a simple web request for the directory that will
reveal the sensitive files. The attacker can then retrieve the files for
information that can be used in later attacks against the server or
application.

--
Ease of Attack:
Simple. Exploit software not required.

--
False Positives:
None known.

--
False Negatives:
None known.

--
Corrective Action:
Ensure the system is using an up to date version of the software and has
had all vendor supplied patches applied.

Check the host logfiles and application logs for signs of compromise.

--
Contributors:
Sourcefire Research Team
Brian Caswell <[e-mail]>
Nigel Houghton <[e-mail]>

--
Additional References:


--