HTTP GET request contains "dot dot dot" (HTTP_GET_Dotdotdot_Data)

About this signature or vulnerability

RealSecure Desktop Protector, RealSecure Server Sensor, RealSecure Network, BlackICE Server Protection, BlackICE PC Protection, BlackICE Agent for Server, RealSecure Sentry, RealSecure Guard, Proventia Network MFS, IBM Security Server Protection for Windows, Proventia Desktop, Proventia Network IDS, Proventia-G 1.1 and earlier, RealSecure Desktop Protector 3.6, Proventia Network IPS, Proventia Server IPS for Linux technology, Virtual Server Protection for Vmware:

This signature detects HTTP GET requests that contain "/..." in the data.

This signature detects HTTP GET requests that contain "/..." in the argument data.

Default risk level

 Medium

Sensors that have this signature

RealSecure Desktop Protector: 3.6, RealSecure Server Sensor: 7.0, RealSecure Network: 7.0, BlackICE Server Protection: 3.6.cbd, BlackICE PC Protection: 3.6.cbd, BlackICE Agent for Server: 3.6, RealSecure Sentry: 3.6, RealSecure Guard: 3.6, Proventia Network MFS: 1.0, IBM Security Server Protection for Windows: 2.1.14.2400, IBM Security Server Protection for Windows: 1.0.914.0, Proventia Desktop: 8.0.614.1, Proventia Network IDS: A Series, Proventia-G 1.1 and earlier: G Series, RealSecure Desktop Protector 3.6: baseline, Proventia Network IPS: 2.0, Proventia Server IPS for Linux technology: 1.0, RealSecure Desktop: baseline, Virtual Server Protection for Vmware: 1.0

Systems affected

Various vendors Any application, IETF HTTP/1.1

Type

Suspicious Activity

Vulnerability description

How to remove this vulnerability

References