[Snort-sigs] Bleedingsnort.com Daily Update

[***] Results from Oinkmaster started Sat Nov 27 21:00:03 2004 [***]

[+++]          Added rules:          [+++]

     -> Added to bleeding-virus.rules (1):
        alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"W32/Bagle.z@MM Requesting 5.php"; content:"GET /5.php"; 
reference:mcafee,122415; classtype:trojan-activity; sid:2001556; rev:1;)

     -> Added to bleeding.rules (1):
        alert tcp any any -> $HOME_NET 42 (msg:"BLEEDING-EDGE ATTACK WINS 
replication overflow attempt"; byte_test:4,>,200000,0; byte_test:1,=,255,6; 
classtype:misc-attack; 
reference:url,www.immunitysec.com/downloads/instantanea.pdf; sid:2001555; 
rev:1;)

[+++]      Added non-rule lines:     [+++]

     -> Added to bleeding-sid-msg.map (2):
        2001555 || BLEEDING-EDGE ATTACK WINS replication overflow attempt || 
url,www.immunitysec.com/downloads/instantanea.pdf
        2001556 || W32/Bagle.z@MM Requesting 5.php || mcafee,122415

     -> Added to bleeding-virus.rules (1):
        #Submitted by Mark Mcdonagh

     -> Added to bleeding.rules (1):
        #Submitted by Obiwan

[*] Added files: [*]
    None.



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs