HTTP: Authorization Overflow

This protocol anomaly triggers when an HTTP authorization header exceeds the user-defined maximum. The default length is 1024 bytes; you can change this setting in the Sensor Settings Rulebase>Protocol Thresholds and Configuration>HTTP>Maximum Authorization Length.

Extended Description

Receiving such a message may indicate an attack attempt. The impact depends on how an HTTP server handles such a malformed message.

References

BugTraq: 8375 9633 99569 37896

CVE: CVE-2003-0727

URL: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.8 http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html http://www.ietf.org/rfc/rfc3548.txt http://www.faqs.org/rfcs/rfc2617.html http://www.us-cert.gov/cas/techalerts/TA04-041A.html http://www.kb.cert.org/vuls/id/216324

Short Name

HTTP:OVERFLOW:AUTHORIZATION

Severity

Major

Recommended

False

Recommended Action

None

HTTP: Authorization Overflow

Extended Description

References

Found a potential security threat?