I need to know if somebody have some script to can update of signature
of the snort automatically......
**********************************
Ing. Javier Guamán R.
Web: www.novadevices.com
Telèfono: (593-2) 225-7711 ext. 120
Celular: 099034993
Av. Brasil N45-08 y Condor, Quito Ecuador
**********************************
-----Original Message-----
From: snort-sigs-admin@lists.sourceforge.net
[mailto:snort-sigs-admin@lists.sourceforge.net] On Behalf Of Russell
Fulton
Sent: Miércoles, 29 de Septiembre de 2004 19:04
To: Lazarakis, Dan
Cc: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] Mime type filtering when looking for GDI+
On Thu, 2004-09-30 at 06:39, Lazarakis, Dan wrote:
FYI only
I noticed on incidents.org that Judy Novak created some snort sigs the
other day (Spet 22) to detect malicious jpegs. I thought everyone
should know that the mime type/content type they look for is
'image/jp*'. But the world needs to be aware that "image/pjp*" is also
a valid mime type for jpegs. Matter of fact, I've been seeing a lot of
"image/pjpeg" files traversing our perimeter. Where this mime type
comes from is a mystery as it is not listed in some of the HTTP
resources I've searched. Rumor has it that Japanese IIS servers
generate this mime type, but as I said, it is rumor.
It is my considered opinion that any defencive measure based on MIME
types (or on file name/extensions) is fatally floored. Many products
(IE prominent amongst them) will figure out the type of a file
regardless of the MIME type or file name. Sigh...
Yes, this causes problems for things like snort and makes it much more
difficult to write effective rules that don't have lots of false
positives.
--
Russell Fulton, Information Security Officer, The University of Auckland
New Zealand
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give
us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find
out more http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
***************************************************
This message has been scanned for viruses and
dangerous content by Kypus Server Appliance E-Mail
Protection Service, and is believed to be clean.
***************************************************
=-=-=-=-=-=-=-=-=-=-=-=-Disclaimer Notice-=-=-=-=-=-=-=-=-=-=-=-=-=
The information in this E-mail is intended to be confidential and
only for use of the individual or entity to whom it is addressed.
If you are not the intended recipient, any retention, dissemination,
distribution or copying of this message is strictly prohibited and
sanctioned by law. If you receive this message by error, please
immediately send it back and delete the message received.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
