Unable to find bugid listed in S61 readme

[mjuckett]

I am trying to view the list of signatures that were disabled in the S61 upgrade. The bugid we are given is CSCec88388. I keep getting told that it doesn't find that id. Can someone verify if this is the correct ID or link directly to that bug please?

Thanks.

[marcabal]

Try this link:

http://www.cisco.com/cgi-bin/Support/Bugtool/onebug.pl?bugid=CSCec88388&Submit=Search

[mjuckett]

My apologies if this double-posts but I can't see my previous reply. I am still getting the error message. Listed below is the error I am receiving:

Sorry -- The defect you have requested CSCec88388 - cannot be displayed.

This may be due to one or more of the following:

The defect number does not exist.

The defect does not have a customer-visible description available yet.

The defect has been marked Cisco Confidential.

[marcabal · Accepted solution]

I am not sure why it is not viewable.

I can see it just fine.

It could be that the system can tell I am an internal Cisco user and is showing me the details while it won't let an external viewer see them.

I will check into it.

In the mean time, here is the list of signatures that have been retired (They have had their

enabled parameter set to False, to re-enable them simply set their enabled parameter to True) because they are for older vulnerabilities not seen in the latest OS version, or the patch has been out for awhile. Disabling these signatures save system resources on the sensors and increases overall sensor performance.

Here is the list of signatures:

1000.0 BAD IP OPTION

1001.0 Record Packet Rte

1002.0 Timestamp

1003.0 Provide s,c,h,tcc

1005.0 SATNET ID

1201.0 Frag Overlap

2153.0 ICMP Smurf attack

3001.0 TCP Port Sweep

3042.0 TCP FIN Packet

3100.0 SMTP RCPT TO: Bounce

3101.0 SMTP To: Bounce

3103.0 SMTP (EXPN or VRFY)

3103.1 SMTP (EXPN or VRFY)

3104.0 SMTP Archaic

3104.1 SMTP Archaic

3105.0 SMTP Decode

3107.0 SMTP Majordomo Attack

3108.0 SMTP MIME Content Overflow

3111.0 W32 Sircam Malicious Code

3111.1 W32 Sircam Malicious Code

3112.0 Lotus Notes Mail Loop DoS

3114.0 Fetchmail Arbitrary Code Execution

3117.0 KLEZ worm

3117.1 KLEZ worm

3120.0 ANTS Virus

3120.1 ANTS Virus

3125.0 Postfix 1.1.12 envelope address DoS

3126.0 Postfix bounce scan

3153.0 FTP Improper Address

3154.0 FTP Improper port

3162.0 glFtpD LIST DoS

3163.0 wu-ftpd heap corruption

3164.0 Instant Server Mini Portal Directory Traversal

3165.0 FTP SITE EXEC

3200.0 WWW phf

3204.0 WWW .bat file

3208.0 WWW campas attack

3209.0 WWW glimpse server attack

3210.0 WWW IIS View Source Bug

3210.1 WWW IIS View Source Bug

3210.2 WWW IIS View Source Bug

3210.3 WWW IIS View Source Bug

3212.0 WWW NPH-TEST-CGI Bug

3213.0 WWW TEST-CGI Bug

3215.0 IIS DOT DOT EXECUTE Attack

3216.0 WWW Directory Traversal ../..

3217.0 WWW php view file Bug

3218.0 WWW SGI wrap bug

3219.0 WWW php buffer overflow

3221.0 WWW View Source GGI Bug

3222.0 WWW MLOG/MYLOG CGI Bug

3223.0 WWW Handler CGI BUG

3224.0 WWW Webgais Bug

3225.0 WWW websendmail File Access

3226.0 WWW Webdist Bug

3227.0 WWW Htmlscript Bug

3228.0 WWW Perfomer Bug

3229.0 WebSite win-c-sample buffer overflow

3230.0 WebSite uploader

3231.0 Novell convert Bug

3233.0 WWW count-cgi Overflow

3306.0 SMB Remote Registry access attempt

3307.0 SMB Redbutton reconnaissance

3401.0 IFS=/

3401.1 IFS=/

3405.0 Avirt Gateway proxy Telnet Buffer Overflow

3451.0 BearShare Directory Traversal

3452.0 gopherd halidate Overflow

3455.0 Java Web Server Cmd Exec

3456.0 Solaris in.fingerd Information Leak

3456.1 Solaris in.fingerd Information Leak

3456.3 Solaris in.fingerd Information Leak

3457.0 Finger root shell

3458.0 AIM game invite overflow

3459.0 ValiCert forms.exe overflow

3459.1 ValiCert forms.exe overflow

3461.0 Finger probe

3462.0 Finger Redirect

3463.0 Finger root

3464.0 File access in finger

3500.0 rlogin -froot

3701.0 Oracle 9iAS Web Cache Buffer Overflow

3705.0 Tivoli Storage Manager Client Acceptor Overflow

3707.0 Perl fingerd Command Exec

3734.0 Cfengine Overflow

3990.1 BO2K-TCP-nonStealth

3990.2 BO2K-TCP-nonStealth

3991.0 BO2K-TCP-XOR

3992.1 BO2K-TCP-Stealth

3992.2 BO2K-TCP-Stealth

3992.3 BO2K-TCP-Stealth

3992.4 BO2K-TCP-Stealth

3992.5 BO2K-TCP-Stealth

4053.0 BackOrifice-Original-UDP

4055.1 B02K-UDP

4061.0 Chargen Echo DoS

4150.0 Ascend Kill

4506.0 D-Link Wireless SNMP Plain Text Password

5034.0 WWW IIS newdsn attack

5035.0 WWW faxsurvey?

5037.0 WWW MachineInfo attempt

5038.0 WWW wwwsql file read Bug

5041.0 WWW anyform attack

5043.1 WWW Cold Fusion Attack

5043.2 WWW Cold Fusion Attack

5043.3 WWW Cold Fusion Attack

5044.0 WWW Webcom.se Guestbook attack

5048.0 WWW IIS BAT EXE attack

5049.0 WWW IIS showcode.asp access

5050.0 WWW IIS .htr Overflow

5052.0 WWW VTI Open attempt

5053.0 WWW VTI bin list attempt

5054.0 WWW WWWBoard attack

5057.0 WWW Sambar Samples

5057.1 WWW Sambar Samples

5058.0 WWW info2www attack

5059.0 WWW Alibaba attack

5059.1 WWW Alibaba attack

5059.2 WWW Alibaba attack

5060.0 WWW Excite AT-generate.cgi access

5061.0 WWW catalog_type.asp access

5062.0 WWW classifieds.cgi attack

5063.0 WWW dbmlparser.exe access

5064.0 WWW imagemap.cgi attack

5065.0 WWW IRIX infosrch.cgi attack

5067.0 WWW plusmail attack

5068.0 WWW formmail.pl access

5069.0 WWW whois_raw.cgi attack

5072.0 WWW bizdb1-search.cgi attack

5073.0 WWW EZShopper loadpage.cgi attack

5074.0 WWW EZShopper search.cgi attack

5075.0 WWW IIS Virtualized UNC Bug

5076.0 WWW webplus bug

5077.0 WWW Excite AT-admin.cgi access

5078.0 WWW Piranha passwd attack

5079.0 WWW PCCS MySQL admin access

5080.0 WWW IBM WebSphere access

5083.0 WWW Virtual Vision FTP browser access

5084.0 WWW Alibaba attack 2

5084.1 WWW Alibaba attack 2

5085.0 WWW IIS Source Fragment access

5086.0 WWW WEBactive Logfile access

5087.0 WWW Sun Java Server access

5087.1 WWW Sun Java Server access

5088.0 WWW Akopia MiniVend access

5089.0 WWW Big Brother directory access

5090.0 WWW Frontpage htimage.exe access

5091.0 WWW Cart32 Remote Admin access

5091.1 WWW Cart32 Remote Admin access

5092.0 WWW CGI-World Poll It access

5093.0 WWW PHP-Nuke admin.php3 access

5095.0 WWW CGI Script Center Account Manager attack

5096.0 WWW CGI Script Center Subscribe Me attack

5097.0 WWW FrontPage MS-DOS Device attack

5097.1 WWW FrontPage MS-DOS Device attack

5097.2 WWW FrontPage MS-DOS Device attack

5099.0 WWW GWScripts News Publisher access

List continues in next post (there is a limit on the number of characters in a post so I can't put the whole list in one post)

[marcabal]

Continued list:

5100.0 WWW CGI Center Auction Weaver file access

5101.0 WWW CGI Center Auction Weaver attack

5102.0 WWW phpPhotoAlbum explorer.php access

5103.0 WWW SuSE Apache CGI Source access

5104.0 WWW YaBB file access

5105.0 WWW Randy Johnson mailto.cgi attack

5106.0 WWW Randy Johnson mailform.pl access

5107.0 WWW Mandrake Linux /perl access

5108.0 WWW Netegrity SiteMinder access

5108.1 WWW Netegrity SiteMinder access

5108.2 WWW Netegrity SiteMinder access

5109.0 WWW Sambar Beta search.dll access

5109.1 WWW Sambar Beta search.dll access

5110.0 WWW SuSE Installed Packages access

5111.0 WWW Solaris AnswerBook 2 access

5112.0 WWW Solaris AnswerBook 2 attack

5113.0 WWW CommuniGate Pro access

5115.0 WWW Netscape Server with ?wp tags

5115.1 WWW Netscape Server with ?wp tags

5115.2 WWW Netscape Server with ?wp tags

5115.3 WWW Netscape Server with ?wp tags

5115.4 WWW Netscape Server with ?wp tags

5115.5 WWW Netscape Server with ?wp tags

5115.6 WWW Netscape Server with ?wp tags

5116.0 WWW Endymion MailMan Cmd Exec

5117.0 WWW PhpGroupware Cmd Exec

5118.0 WWW eWave ServletExec File Upload

5119.0 WWW CGI News Update Admin Pass Change

5120.0 Netscape Server Suite Buffer Overflow

5121.0 WWW iPlanet .shtml Buffer Overflow

5122.0 WWW Nokia IP440 Denial of Service

5124.0 WWW IIS Double Decode Error

5124.1 WWW IIS Double Decode Error

5124.2 WWW IIS Double Decode Error

5125.0 PerlCal Directory Traversal

5127.0 WWW viewsrc.cgi Directory Traversal

5128.0 WWW nph-maillist.pl Cmd Exec

5130.0 Bugzilla Privileged Information Disclosure

5131.0 talkback.cgi Directory Traversal

5132.0 VirusWall catinfo Buffer Overflow

5133.0 Net.Commerce Macro Path Disclosure

5134.0 MacOS PWS DoS

5140.0 Net.Commerce Macro Denial of Service

5141.0 NCM Content Mgmt Input Validation

5142.0 DCShop File Disclosure

5142.1 DCShop File Disclosure

5147.0 Arcadia Internet Store Directory Traversal Bug

5148.0 Perception LiteServe CGI Source Code Disclosure

5149.0 Trend Micro Viruswall Configuration Modification

5150.0 Interscan Viruswall RegGo.dll Buffer Overflow

5151.0 WebStore Admin Bypass

5152.0 WebStore Command Exec

5154.0 WWW uDirectory Directory Traversal

5155.0 WWW SiteWare Editor Directory Traversal

5156.0 WWW Microsoft fp30reg.dll Overflow

5157.0 Tarantella TTAWebTop.CGI Directory Traversal Bug

5160.0 Apache ? indexing file disclosure bug

5162.0 Active Classifieds Command Exec

5163.0 Mambo Site Server Administrator Password Bypass

5164.0 PHPBB Remote SQL Query Manipulation

5165.0 php-nuke article.php sql query

5166.0 php-nuke modules.php DoS

5167.0 phpMyAdmin Cmd Exec 2

5168.0 Snapstream PVS Directory Traversal Vulnerability

5169.0 Snapstream PVS Plaintext Password Vulnerability

5171.0 NC-Book book.cgi Cmd Exec

5172.0 WinWrapper Admin Server Directory Traversal

5173.0 Directory Manager Cmd Exec

5174.0 phpmyexplorer directory traversal

5175.0 Hassan Shopping Cart Command Exec

5176.0 Exchange Address List Disclosure

5178.0 MS Index Server File/Path Recon

5179.0 PHP-Nuke File Upload

5180.0 sglMerchant Directory Traversal

5181.0 MacOS Apache File Disclosure

5181.1 MacOS Apache File Disclosure

5182.0 WebDiscount E-Shop Remote Command Exec

5191.0 Active Perl PerlIS.dll Buffer Overflow

5196.0 Red Hat Stronghold Recon attack

5196.1 Red Hat Stronghold Recon attack

5197.0 Network Query Tool command Exec

5199.0 W3Mail Command Exec

5200.0 IIS Data Stream Source Disclosure

5201.0 PHP-Nuke Cross Site Scripting

5201.1 PHP-Nuke Cross Site Scripting

5201.2 PHP-Nuke Cross Site Scripting

5202.0 PHP-Nuke File Copy / Delete

5202.1 PHP-Nuke File Copy / Delete

5203.0 Hosting Controller File Access and Upload

5204.0 AspUpload Sample Scripts

5204.1 AspUpload Sample Scripts

5205.0 Apache php.exe File Disclosure

5206.0 Horde IMP Session Hijack

5207.0 Entrust GetAccess directory traversal

5207.1 Entrust GetAccess directory traversal

5208.0 Network Tools shell metacharacters

5209.0 Agora.cgi Cross Site Scripting

5210.0 FAQManager.cgi directory traversal

5210.1 FAQManager.cgi directory traversal

5211.0 zml.cgi File Disclosure

5212.0 Bugzilla Admin Authorization Bypass

5214.0 FAQManager.cgi null bytes

5215.0 lastlines.cgi cmd exec/traversal

5215.1 lastlines.cgi cmd exec/traversal

5216.0 PHP Rocket Directory Traversal

5216.1 PHP Rocket Directory Traversal

5217.0 Webmin Directory Traversal

5219.0 Lotus Domino database DoS

5220.0 CSVForm Remote Command Exec

5221.0 Hosting Controller Directory Traversal

5221.1 Hosting Controller Directory Traversal

5221.2 Hosting Controller Directory Traversal

5221.3 Hosting Controller Directory Traversal

5221.4 Hosting Controller Directory Traversal

5223.0 Pi3Web Buffer Overflow

5224.0 SquirrelMail SquirrelSpell Command Exec

5230.0 Lotus Domino Authentication Bypass

5231.0 MRTG Directory Traversal

5232.0 URL with XSS

5233.0 PHP fileupload Buffer Overflow

5234.0 pforum sql-injection

5234.1 pforum sql-injection

5236.0 Xoops sql-injection

5238.0 EZNET Ezboard Buffer OVerflow

5239.0 Sambar cgitest.exe Buffer Overflow

5240.0 Marcus Xenakis Shell Command Exec

5241.0 Avenger System Command Exec

5243.0 CS .cgi Script Cmd Exec

5243.1 CS .cgi Script Cmd Exec

5243.2 CS .cgi Script Cmd Exec

5243.3 CS .cgi Script Cmd Exec

5243.4 CS .cgi Script Cmd Exec

5243.5 CS .cgi Script Cmd Exec

5244.0 PhpSmsSend Command Exec

5249.0 IDS Evasive Encoding

5250.0 IDS Evasive Double Encoding

5255.0 Linux Directory traceroute / nslookup Command Exec

5257.0 PHPNetToolpack traceroute Command Exec

5258.0 Script source disclosure with CodeBrws.asp

5259.0 Snitz Forums SQL injection

5260.0 Xpede sprc.asp SQL Injection

5262.0 Large number of Slashes URL

5266.0 iCat Carbo Server File Disclosure

5271.0 search.cgi Directory Traversal

5272.0 count.cgi GIF File Disclosure

5274.0 Netpad.cgi Directory Traversal/Cmd Exec

5274.1 Netpad.cgi Directory Traversal/Cmd Exec

5275.0 Phorum Remote Cmd Exec

5275.1 Phorum Remote Cmd Exec

5277.0 dfire.cgi Command Exec

5279.0 JJ Cgi Cmd Exec

5283.0 info2www CGI Directory Traversal

5284.0 IIS webhits.dll Directory Traversal

5285.0 PHPEventCalendar Cmd Exec

5286.0 WebScripts WebBBS Cmd Exec

5294.0 BearShare File Disclosure

5306.0 SoftCart storemgr.pw File Access

5325.0 Contivity cgiproc DoS

5331.0 Image Javascript insertion

5334.0 DB4Web File Disclosure

5335.0 DB4WEB Proxy Scan

5339.0 SunONE Directory Traversal

5340.0 Killer Protection Credential File Access

5341.0 HP Procurve 4000M Switch DoS

5342.0 Invision Board phpinfo.php Recon

5343.0 Apache Host Header Cross Site Scripting

5345.0 HTTPBench Information Disclosure

5346.0 BadBlue Information Disclosure

5347.0 Xoops WebChat SQL Injection

5348.0 Cobalt RaQ Server overflow.cgi Cmd Exec

5349.0 Polycom ViewStation Admin Password

5352.0 H-Sphere Webshell Buffer Overflow

5353.0 H-Sphere Webshell 'mode' URI exec

5354.0 H-Sphere Webshell 'zipfile' URI exec

5355.0 DotBr exec.php3 exec

5356.0 DotBr system.php3 exec

5357.0 IMP SQL Injection

5358.0 Psunami.CGI Remote Command Execution

5367.0 Apache CR / LF DoS

5380.0 phpBB SQL injection

5381.0 VPASP SQL injection

5382.0 Xpressions SQL Admin Bypass

5388.0 Kerio MailServer Webmail multiple overflows

5388.1 Kerio MailServer Webmail multiple overflows

5388.2 Kerio MailServer Webmail multiple overflows

5388.3 Kerio MailServer Webmail multiple overflows

6001.0 SATAN-Normal

6002.0 SATAN-Heavy

6050.0 DNS HINFO

6050.1 DNS HINFO

6051.0 DNS Zone Xfer

6051.1 DNS Zone Xfer

6052.0 DNS High Zone Xfer

6052.1 DNS High Zone Xfer

6102.0 RPC Dump

6102.1 RPC Dump

6112.0 RPC NFS Sweep

6112.1 RPC NFS Sweep

6150.0 ypserv Portmap Request

6150.1 ypserv Portmap Request

6151.0 ypbind Portmap Request

6151.1 ypbind Portmap Request

6153.0 ypupdated Portmap Request

6153.1 ypupdated Portmap Request

6154.0 ypxfrd Portmap Request

6154.1 ypxfrd Portmap Request

6175.0 rexd Portmap Request

6175.1 rexd Portmap Request

6189.1 statd automount attack

6277.0 Show Mount Recon

6277.1 Show Mount Recon

6300.0 Loki ICMP tunnel

[mjuckett]

Thank you very much for the list!