Rule:  
--

Sid:
1372

--

Summary:
An attacker may have attempted to load the /etc/shadow password file through
a web server.

--
Impact:
An attacker may have gotten the /etc/shadow password file.  This is unlikely
to succeed with modern web servers, however.

--
Detailed Information:
An older method of cracking web servers is to retrieve the /etc/passwd
or /etc/shadow file and then running that file through a password cracker
to obtain logins and passwords to the system.

--
Affected Systems:
 
--
Attack Scenarios:
Attacker sends a hand-crafted URL, usually using a directory traversal
attempt, to get the shadow password file.  If the attack is successful,
the attacker will mostly likely run the shadow file through a password
cracker.

--
Ease of Attack:
This attack is highly unlikely to work against any modern web server.

--
False Positives:
None Known

--
False Negatives:
None Known

--
Corrective Action:
Examine the captured packet to determine whether the request was malicious
or not.  Determine whether the targetted web server was vulnerable to this
kind of attack.

--
Contributors:
Original rule writer unknown
Original document author unkown
Sourcefire Vulnerability Research Team
Nigel Houghton <nigel.houghton@sourcefire.com>

--
References:
