1158.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule:  

--

Sid:
1158

--

Summary:
This event is generated when an attempt is made to access the executable
file WindMail.exe using a web connection.

--
Impact:
Remote attackers could subvert the WindMail mailer to read or execute
arbitrary files on the web server

--
Detailed Information:
WindMail is a commandline mail program for Windows.  It is sometimes
deployed for scripting or for sending email through a web application.
Some windmail deployments make webmail.exe a CGI application, which it was
not designed to do.  The result is that an attacker could read or
execute arbitrary files on the system that the web server has access to.
It should never be a CGI application itself, and instead should be called
by another program that properly filters input.

--
Affected Systems:
	All systems using windmail.exe

--
Attack Scenarios:
http://target/cgi-bin/windmail.exe?%20-n%20desired.file%20attacker_email_address

--
Ease of Attack:
Simple crafting of a web GET request

--
False Positives:
None Known

--
False Negatives:
If a CGI script calls windmail.exe, but windmail.exe itself is not a CGI
application, then this rule will not generate an event. If the CGI
application does not properly filter input, there is a possibility
that the attack could still succeed.

--
Corrective Action:
Look at the packet to determine whether a request was made via an HTTP GET
for the windmail.exe application. If so, determine whether the attacked
web server had windmail.exe on it.

--
Contributors:
Original rule writer unknown
Original document author unkown
Sourcefire Vulnerability Research Team
Nigel Houghton <[e-mail]>

--
Additional References:


--