Idp Service Groups - ZyXEL Communications ZyWall USG 2000 User Manual

Chapter 31 IDP
Table 148 Policy Types (continued)
POLICY TYPE
Buffer Overflow
Virus/Worm
Backdoor/Trojan
Access Control
Web Attack

31.6.3 IDP Service Groups

An IDP service group is a set of related packet inspection signatures.
Table 149 IDP Service Groups
WEB_PHP
WEB_CGI
SQL
RPC
ORACLE
MISC_EXPLOIT
IMAP
FINGER
The following figure shows the WEB_PHP service group that contains signatures
related to attacks on web servers using PHP exploits. PHP (PHP: Hypertext
Preprocessor) is a server-side HTML embedded scripting language that allows web
developers to build dynamic websites.
500
DESCRIPTION
A buffer overflow occurs when a program or process tries to store
more data in a buffer (temporary data storage area) than it was
intended to hold. The excess information can overflow into adjacent
buffers, corrupting or overwriting the valid data held in them.
Intruders could run codes in the overflow buffer region to obtain
control of the system, install a backdoor or use the victim to launch
attacks on other devices.
A computer virus is a small program designed to corrupt and/or alter
the operation of other legitimate programs. A worm is a program that
is designed to copy itself from one computer to another on a network.
A worm's uncontrolled replication consumes system resources, thus
slowing or stopping other tasks.
A backdoor (also called a trapdoor) is hidden software or a hardware
mechanism that can be triggered to gain access to a program, online
service or an entire computer system. A Trojan horse is a harmful
program that is hidden inside apparently harmless programs or data.
Although a virus, a worm and a Trojan are different types of attacks,
they can be blended into one attack. For example, W32/Blaster and
W32/Sasser are blended attacks that feature a combination of a
worm and a Trojan.
Access control refers to procedures and controls that limit or detect
access. Access control attacks try to bypass validation checks in order
to access network resources such as servers, directories, and files.
Web attacks refer to attacks on web servers such as IIS (Internet
Information Services).
WEB_MISC WEB_IIS
WEB_ATTACKS TFTP
SNMP SMTP
POP3 POP2
NNTP NETBIOS
MISC_DDOS MISC_BACKDOOR
IM ICMP
DNS
WEB_FRONTPAGE
TELNET
RSERVICES
P2P
MYSQL
MISC
FTP
ZyWALL USG 2000 User's Guide