3131.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule: 

--
Sid: 
3131

-- 
Summary: 
This event is generated when an attempt is made to exploit a known
vulnerability in GNU Mailman.

-- 
Impact: 
Information disclosure.

--
Detailed Information:
GNU Mailman is used to manage mailing lists. It is written in Python and
is available on a variety of platforms.

GNU Mailman when used with webservers that do not remove extra slashes
from URLs, is prone to a directory traversal attack that may allow an
attacker access to sensitive files on an affected system.

--
Affected Systems:
	GNU Mailman in conjunction with Apache 1.3.x

--
Attack Scenarios: 
An attacker can supply extra slashes and dots (....///) to a URL to
escape the web root and access other parts of the host filesystem.

-- 
Ease of Attack: 
Simple. Exploit software is not required.

-- 
False Positives:
None known.

--
False Negatives:
None known.

-- 

Corrective Action: 
Apply the appropriate vendor supplied patches.

--
Contributors: 
Sourcefire Vulnerability Research Team
Brian Caswell <[e-mail]>
Nigel Houghton <[e-mail]>

-- 
Additional References:

--