TROJAN: BackOrifice Web Server Response
This signature detects the format string "BO" within an outgoing HTTP response sent from local port 80. This can indicate that an attacker is using the Trojan Back Orifice to remotely control the system.
Extended Description
BackOrifice is a remote adminstration tool. It enables remote attackers to gain control over an infected machine.
Short Name
TROJAN:BACKORIFICE:WEB-SERVER
Severity
Major
Recommended
False
Recommended Action
Drop
Category
TROJAN
Keywords
BackOrifice CVE-1999-0660 Response Server Web
Release Date
04/22/2003
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3375
False Positive
Unknown
CVSS Score
8.8