[***] Results from Oinkmaster started Wed Sep 22 20:00:01 2004 [***]
[+++] Added rules: [+++]
-> Added to bleeding.rules (3):
alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"BLEEDING-EDGE RDP
connection request"; content: "|03|"; offset: 0; depth: 1; content: "|E0|";
offset:5; depth: 1; flags: A+; priority:1; sid:2001329; rev:1;)
alert tcp $HOME_NET 3389 -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE RDP
connection confirm"; content: "|03|"; offset: 0; depth: 1; content: "|D0|";
offset:5; depth: 1; flags: A+; priority:1; sid:2001330; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"BLEEDING-EDGE RDP
disconnect request"; content: "|03|"; offset: 0; depth: 1; content: "|80|";
offset:5; depth: 1; flags: A+; priority:1; sid:2001331; rev:1;)
[---] Removed rules: [---]
-> Removed from bleeding.rules (2):
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE WEB-CLIENT MS04-028 exploiting jpeg";
flow:to_client,established; content:"Content-Type\: image/jpeg"; content:"|FF
FE 00 00|"; classtype:attempted-user; sid:200326; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE WEB-CLIENT MS04-028 exploiting jpeg";
flow:to_client,established; content:"Content-Type\: image/jpeg"; content:"|FF
FE 00 01|"; classtype:attempted-user;sid:2001327; rev:1;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (3):
2001329 || BLEEDING-EDGE RDP connection request
2001330 || BLEEDING-EDGE RDP connection confirm
2001331 || BLEEDING-EDGE RDP disconnect request
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (2):
200326 || BLEEDING-EDGE WEB-CLIENT MS04-028 exploiting jpeg
2001327 || BLEEDING-EDGE WEB-CLIENT MS04-028 exploiting jpeg
-> Removed from bleeding.rules (1):
#Submitted by Chas Tomlin
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
