Signature Detail
Short Name |
SHELLCODE:LINUX:CHMDSDW-HTTP |
|---|---|
Severity |
Medium |
Recommended |
No |
Recommended Action |
Drop |
Category |
SHELLCODE |
Keywords |
Linux/x86 Shadow File World Read/Write Enable over HTTP |
Release Date |
2013/09/20 |
Update Number |
2302 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
SHELLCODE: Linux/x86 Shadow File World Read/Write Enable over HTTP
This signature detects shellcode designed to modify permissions on the etc/shadow file that stores sensitive password hashes on most Linux systems being sent over HTTP. Attempts to execute such shellcode could be part of an ongoing malicious attack.
References