Red Hat NETWORK 3.6 - Guia do Utilizador descarregar pdf (Página 36)

Case Insensitive Example

There is a tool called SmartDownLoader that uploads and downloads large files.

Unfortunately, versions 0.1 through 1.3 use the syntax “SmartDownloader”, versions 1.4

through 2.7 use “smartdownloader” and versions 2.8 through current uses the syntax

“SMARTdownloader”. Searching for the various combinations of this text with purely the

regex command would cause us to use a statement that looks like this:

regex=[sS][mM][aA][rR][tT][dD]own[lL]oader

However, with the regexi command, the search string is much less complex and less prone

to creating an error:

regexi=smartdownloader

By using regexi, we can more quickly match on all three versions as well as future

permutations of the string “smartdownloader”. In a case such as this, regexi is the logical

choice.

id=8800

dependency=1442

hs_sport=6789

name=SmartDownLoader Detection

description=The remote host is running SmartDownLoader, a tool for

performing rudimentary uploads and downloads of large binary files.

solution=Ensure that this application is in keeping with Corporate

policies and guidelines

risk=MEDIUM

family=PeerToPeer

match=ownloader

regexi=smartdownloader

A complete example PVS plugin using the regexi keyword is shown above. The use of the

match keyword searching for the string “ownloader” is not a typo. By searching for network

sessions that have this string in them first, the PVS can avoid invoking the expensive

regexi search algorithm unless the “ownloader” pattern is present.

Passive Vulnerability Scanner Network Client Detection

id=1010

hs_dport=25

clientissue

name=Buffer overflow in multiple IMAP clients

description=The remote e-mail client is Mozilla 1.3 or 1.4a which is

vulnerable to a boundary condition error whereby a malicious IMAP

server may be able to crash or execute code on the client.

solution=Upgrade to either 1.3.1 or 1.4a

risk=HIGH

match=^From:

match=^To:

match=^Date:

match=^User-Agent: Mozilla

match=!^Received:

1 2 ... 31 32 33 34 35 36 37 38 39 40 41 ... 60 61

Comentários a estes Manuais

Sem comentários

Red Hat NETWORK 3.6 - Guia do Utilizador Página 36

Comentários a estes Manuais

Manuais e produtos relacionados com Servidores Red Hat NETWORK 3.6 -