Page 519 - StudyBook.pdf

Infrastructure Security: System Hardening • Chapter 8 503

can be used to protect Web traffic; however, the protection it offers is not signifi-
cant enough to protect internal accounts on the Internet.

File Traversal
Notes From the Underground…
One of the most famous Web server attacks against the Microsoft IIS is
the file traversal attack. A directory traversal attack would seek to ille-
gally traverse to parent a directory. The idea was to gain access to an
application such as cmd.exe. Once this program was accessed, the
attacker could use it to execute commands on the victim’s computer. This
would allow the attacker to quickly take control of the system and use it
to launch further attacks. The attack was possible because of a buffer
overflow or bug in the code. It could also occur because of the lack of suf-
ficient security controls.

E-mail Servers

E-mail servers have their own set of built-in and application-specific vulnerabilities.
All e-mail servers are vulnerable to normal attacks that are mounted against their
specific OS, but they are also vulnerable to Denial of Service (DoS) attacks, virus
attacks, and relay and spoofing attacks that may affect the level of service.
To protect the servers, the OSes and NOSes on the server must be hardened, as
well as the e-mail service applications. In e-mail, no systems are immune to attack.
There are many deficiencies in the various versions of e-mail server software
such as Sendmail for Linux and UNIX, and the Exchange/Outlook platform.Any
problems that have been exposed must be investigated, to evaluate the services and
functions that should be included in the e-mail service. For example, specific vul-
nerabilities exist if Hypertext Markup Language (HTML) e-mail is used on a
system, both on the e-mail server side and the client side. If HTML e-mail is
chosen, arrangements must be made to apply all security patches to client
machines, browsers, and servers, to protect against arbitrary execution of code. It is
also important to evaluate the messaging and instant messaging capabilities, as the
implementation of Internet Message Access Protocol (IMAP) technologies may also

www.syngress.com