event Rule:
--
Sid:
2466
--
Summary:
This is generated when an attempt is made to gain access to
private resources using Samba.
--
Impact:
Information gathering and system integrity compromise. Possible unauthorized
administrative access to the server.
--
Detailed Information:
This event is generated when an attempt is made to use Samba to gain
access to private or administrative shares on a host.
--
Affected Systems:
All systems using Samba for file sharing.
All systems using file and print sharing for Windows.
--
Attack Scenarios:
Many attack vectors are possible from simple traversal directory to
direct access to Windows adminsitrative shares.
--
Ease of Attack:
Simple. Exploit software is not required.
--
False Positives:
None known.
--
False Negatives:
None known.
--
Corrective Action:
Ensure the system is using an up to date version of the software and has
had all vendor supplied patches applied.
Check the host l...