C8.1 Description

Applications such as on-server virus and spam filters, directory servers, and management and monitoring systems pose a unique security challenge; in addition to compromising the system hosting them, they provide opportunities to attack other systems.

C8.2 Applications Affected

These applications can be divided into multiple categories:

• Directory Servers - Used to maintain user and system information. Compromising these applications can give access to large amounts of information, including usernames and (possibly encrypted) passwords.



• Monitoring Systems - Used to monitor various other systems. These applications often have user accounts on monitored clients, allowing an attacker easy access to client systems.




• Configuration and Patch Systems - These systems are used to maintain client configurations and patches. Compromising these systems provides an easy path to further distribute malware.



• Spam and Virus Scanners - Vulnerabilities in these systems can often be exploited with little or no user interaction, by simply sending a specially-crafted email message. Once compromised, attackers can more easily send spam and virus-containing emails. Additionally, these systems often contain vital information, such as users' mailboxes.

These applications tend to run on a variety of operating systems, including common systems such as Microsoft Windows or Solaris, and rarer systems like HP-UX and Novell Netware.

C8.3 CVE Entries

CVE-2006-5478, CVE-2006-4509, CVE-2006-4510, CVE-2006-4177, CVE-2006-2496, CVE-2006-0992, CVE-2005-3653, CVE-2005-1928, CVE-2005-1929


C8.4 How to Determine If You Are at Risk

• Use a vulnerability scanner.


• Track vendor security announcements.

C8.5 How to Protect Against These Vulnerabilities

• Keep the systems updated with all the latest patches and service packs. if provided, use an automatic update system.


• Use Intrusion Prevention/Detection Systems to prevent/detect attacks exploiting these vulnerabilities.


• Ensure that only authorized users and systems have access to the affected systems.