Rule Document 1:960

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER Microsoft Frontpage service.stp access

Rule Explanation

This event is generated when an attempt is made to exploit a known vulnerability in a web server running Microsoft FrontPage Server Extensions. Impact: Information gathering and system integrity compromise. Possible unauthorized administrative access to the server or application. Possible execution of arbitrary code of the attackers choosing in some cases. Denial of Service is possible. Details: This event is generated when an attempt is made to compromise a host running Microsoft FrontPage Server Extensions. Many known vulnerabilities exist for this platform and the attack scenarios are legion. This event is generated when an attempt is made to retrieve the file service.stp. This file contains sensitive information concerning the location of other sensitive files that contain group and password information. Ease of Attack: Simple. Many exploits exist.

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Brian Caswell Nigel Houghton