[Snort-sigs] SID 1331

Anton Chuvakin anton at ...1177...
Tue Feb 18 19:59:18 EST 2003

# This is a template for submitting snort signature descriptions to
# the snort.org website
# Ensure that your descriptions are your own
# and not the work of others.  References in the rules themselves
# should be used for linking to other's work.
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
# $Id: snort-sid-1328.txt,v 1.1 2003/02/18 20:39:03 anton Exp anton $

(msg:"WEB-ATTACKS uname -a command attempt";
flow:to_server,established; content:"uname%20-a";nocase; sid:1331;
classtype:web-application-attack; rev:4;)

Sid: 1331

Summary: A web command execution attack involving the use of a UNIX
"uname" command

Impact: attacker might have gained an ability to execute commands
remotely on the system

Detailed Information: This signature triggers when a UNIX "uname"
command is used over a plain-text (unencrypted) connection on one of
the specified web ports to the target web server. The "uname" command
is used to display the server's operating system, kernel version, CPU
type and some other data. "-a" flag gives the maximum level of details
for the output. Using "uname -a", the attackers might be able to gain
accurate intelligence on the web server platform. The signature looks
for the "uname" command in the URL part of the client to web server
connection and does not indicate whether the command was actually
successful in showing the system information. The presence of the
"uname" command in the URL indicates that an attacker attempted to
trick the web server into executing system in non-interactive mode
i.e. without a valid shell session. Another case when this signature
might trigger is unencrypted HTTP tunneling connection to the server.

Attack Scenarios: An attacker uses a "uname" command via a web
server connection. He then executes searches his exploit collection
for the exploit against the target platform

Ease of Attack: very easy, no exploit software required

False Positives: none known

False Negatives: none known

Corrective Action: check the web server software for vulnerabilities
and possible upgrade the system to the latest version, also
investigate the server for signs of compromise

Contributors: Anton Chuvakin <http://www.chuvakin.org>

Additional References:

More information about the Snort-sigs mailing list