Javier:
Oinkmaster is all you need. Has everything related to
updating and modifying rules using automated perl
scripts.
http://oinkmaster.sourceforge.net/
--- Javier Guamán <jguaman@novadevices.com> wrote:
I need to know if somebody have some script to can
update of signature
of the snort automatically......
**********************************
Ing. Javier Guamán R.
Web: www.novadevices.com
Telèfono: (593-2) 225-7711 ext. 120
Celular: 099034993
Av. Brasil N45-08 y Condor, Quito Ecuador
**********************************
-----Original Message-----
From: snort-sigs-admin@lists.sourceforge.net
[mailto:snort-sigs-admin@lists.sourceforge.net] On
Behalf Of Russell
Fulton
Sent: Miércoles, 29 de Septiembre de 2004 19:04
To: Lazarakis, Dan
Cc: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] Mime type filtering when
looking for GDI+
On Thu, 2004-09-30 at 06:39, Lazarakis, Dan wrote:
FYI only
I noticed on incidents.org that Judy Novak created
some snort sigs the
other day (Spet 22) to detect malicious jpegs. I
thought everyone
should know that the mime type/content type they
look for is
'image/jp*'. But the world needs to be aware that
"image/pjp*" is also
a valid mime type for jpegs. Matter of fact, I've
been seeing a lot of
"image/pjpeg" files traversing our perimeter.
Where this mime type
comes from is a mystery as it is not listed in
some of the HTTP
resources I've searched. Rumor has it that
Japanese IIS servers
generate this mime type, but as I said, it is
rumor.
It is my considered opinion that any defencive
measure based on MIME
types (or on file name/extensions) is fatally
floored. Many products
(IE prominent amongst them) will figure out the type
of a file
regardless of the MIME type or file name. Sigh...
Yes, this causes problems for things like snort and
makes it much more
difficult to write effective rules that don't have
lots of false
positives.
--
Russell Fulton, Information Security Officer, The
University of Auckland
New Zealand
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide
on ITManagersJournal
Use IT products in your business? Tell us what you
think of them. Give
us Your Opinions, Get Free ThinkGeek Gift
Certificates! Click to find
out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
***************************************************
This message has been scanned for viruses and
dangerous content by Kypus Server Appliance E-Mail
Protection Service, and is believed to be clean.
***************************************************
=-=-=-=-=-=-=-=-=-=-=-=-Disclaimer
Notice-=-=-=-=-=-=-=-=-=-=-=-=-=
The information in this E-mail is intended to be
confidential and
only for use of the individual or entity to whom it
is addressed.
If you are not the intended recipient, any
retention, dissemination,
distribution or copying of this message is strictly
prohibited and
sanctioned by law. If you receive this message by
error, please
immediately send it back and delete the message
received.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide
on ITManagersJournal
Use IT products in your business? Tell us what you
think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates!
Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
_______________________________
Do you Yahoo!?
Declare Yourself - Register online to vote today!
http://vote.yahoo.com
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
