alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"WEB-CLIENT Microsoft emf metafile access";
flow:from_client,established; uricontent:".emf";
reference:bugtraq,10120; reference:bugtraq,9707;
reference:cve,2003-0906; classtype:attempted-user;
sid:2435; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"WEB-CLIENT Outlook EML access";
flow:from_client,established; uricontent:".eml";
reference:nessus,10767; classtype:attempted-user;
sid:1233; rev:11;)
These two rules are firing on hotmail sessions when a
gif file is loaded:
2435
GET /i.p.emfemale.gif HTTP/1.1.
1233
GET /i.p.emlips.gif HTTP/1.1..
So could we generalize and say any HTTP rules that
check file extensions should check for a trailing
space? ".eml " rather than ".eml" Would a webserver
correctly parse GET /problem.emlHTTP/1.1 ?
Also - are we worried about web clients accessing .eml
/.emf on web servers? Seems to me that the attacks
are flowing from hostile websites to hapless browsers
and we should be looking at flow:to_client instead.
__________________________________
Do you Yahoo!?
Make Yahoo! your home page
http://www.yahoo.com/r/hs
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
