Snort-alerts/http-inspect-OVERSIZE-REQUEST-URI-DIRECTORY
http_inspect: OVERSIZE REQUEST-URI DIRECTORY
Identification
| Id | 119-15 |
|---|---|
| Alert | http_inspect: OVERSIZE REQUEST-URI DIRECTORY |
| Classification | unclassified |
Trigger
This event is generated when the http_inspect pre-processor detects a request for a URL that is longer than a specified length. This may indicate an attack or an attempt to evade an IDS.
Lotus Domino Server Web servers are reported prone to a Denial of Service condition when a long request is made to the server using unicode characters. The http_inspect pre-processor will generate this event should a Domino server be attacked in this way.
Specifically, when a request is made to /cgi-bin/ with approximately 330 unicode characters appended to the URL, the webserver will crash and a DoS condition will be evident.
Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
The maximum expected length of the URL is user configured.
Affected systems
- All web servers
- Lotus Domino 6.5.1 and 6.0.3
Impact
Unknown. This may indicate an attempt to evade an IDS or an attack on a web server.
False positives
None known
Scenario
An attacker may supply an over-long URI in an attempt to evade an IDS or in a possible attack against a web server.
Example
Thank you for your comprehension.
Corrective actions
- Check the target host for signs of compromise.
- Apply any appropriate vendor supplied patches.
- Upgrade to the latest non-affected version of the software.