3630.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule:

--
Sid:
3630

--
Summary:
This event is generated when an attempt is made to exploit a known
vulnerability in a Oracle database implementation.

--
Impact:
Serious. Execution of arbitrary code may be possible. A Denial of
Service (DoS) condition may also be caused.

--
Detailed Information:
An attacker can supply the Oracle XDB FTP service an overly long
value to the FTP TEST subcommand.  This can cause a buffer overflow,
allowing an attacker to execute arbitrary code.  An attacker must
be authenticated to the FTP service in order to exploit this
vulnerability.

--
Affected Systems:
       Oracle9i

--
Attack Scenarios:
An attacker can attempt to connect to Oracle XDB FTP supplying the
TEST subcommand an overly long value.  The result could permit the
attacker to gain escalated privileges and run code of their
choosing.

--
Ease of Attack:
Simple.

--
False Positives:
None known.

--
False Negatives:
None known.

--
Corrective Action:
Ensure the system is using an up to date version of the software and has
had all vendor supplied patches applied.

--
Contributors:
Sourcefire Vulnerability Research Team
Matt Watchinski <[e-mail]>
Brian Caswell <[e-mail]>
Nigel Houghton <[e-mail]>
Judy Novak <[e-mail]>

--
Additional References:

Other:
http://www.appsecinc.com/Policy/PolicyCheck71.html

--