Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual page 972

Network and Security Manager Administration Guide
POP3:EXT:DOUBLE-DOT-DOT
POP3:FAILURE:BRUTE-FORCE
POP3:OUTLOOK:TROUBLE-QUERY-OF
POP3:OVERFLOW:APOP
POP3:OVERFLOW:BOUNDARY_OVERFLOW
POP3:OVERFLOW:COMMAND
POP3:OVERFLOW:CONTENT_NAME
POP3:OVERFLOW:FILENAME2LONG
POP3:OVERFLOW:LINE
POP3:OVERFLOW:PASS
POP3:OVERFLOW:QPOP-OF1
POP3:OVERFLOW:QPOP-OF2
922
This signature detects e-mail attachments that contain two
file extensions. Attackers or viruses may send e-mail
attachments that use two file extensions to disguise the
actual file name and trick users into opening a malicious
attachment.
This protocol anomaly is multiple login failures within a short
period of time between a unique pair of hosts. The default
is 4.
This signature detects buffer overflow attempts against an
ActiveX control in Microsoft Outlook. The Local
Troubleshooter ActiveX control has inadequate bounds for
checking for its Query function, and this exploit bypasses
normal Outlook/IE ActiveX security controls. Attackers may
create a malicious Web site that contains a call to this
ActiveX control; this call contains an overly long string that
overflows the control buffer, enabling the attacker to gain
control of the target system with the user privileges.
This protocol anomaly is a POP3 APOP command argument
that is too long. This may indicate a buffer overflow attempt.
This protocol anomaly is a message with more than 70
boundary characters.
This protocol anomaly is a POP3 command that exceeds 4
bytes, the standard length for a POP3 command. This may
indicate a nonstandard POP3 client/server or an attacker
has gained command-line access to the server.
This protocol anomaly is a mime header content-type with
a name length that is longer than the defined value. The
default value is 128.
This protocol anomaly is a message with a
content_disposition header containing a 'name' attribute
value that is too long.
This protocol anomaly is a text-line from a POP3 client to
the server that is too long. This may indicate a buffer
overflow attempt.
This protocol anomaly is a POP3 PASS command argument
that is too long. This may indicate a buffer overflow attempt.
This signature detects buffer overflow attempts against
Qpopper, a POP3 server for Unix. Qpopper 3.0beta20 and
earlier versions are vulnerable.
This signature detects a buffer overflow attempt to exploit
a vulnerability in Qpopper. Version 3.0beta30 and many
earlier versions are vulnerable.
high sos5.1.0
high sos5.1.0
high sos5.1.0
high sos5.0.0,
sos5.1.0
high sos5.1.0
high sos5.0.0,
sos5.1.0
high sos5.1.0
high sos5.1.0
high sos5.0.0,
sos5.1.0
high sos5.0.0,
sos5.1.0
critical sos5.0.0,
sos5.1.0
critical sos5.0.0,
sos5.1.0
Copyright © 2010, Juniper Networks, Inc.