On 0, rmkml <rmkml@free.fr> allegedly wrote:
Hi,
sid 1701 :
web-cgi.rules:alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
(msg:"WEB-CGI calendar-admin.pl access"; flow:to_server,established;
uricontent:"/calendar-admin.pl"; nocase; reference:bugtraq,1215;
classtype:web-application-activity; sid:1701; rev:4;)
but bid 1215 is :
http://online.securityfocus.com/bid/1215/exploit
and cve 2000-0432 confirm this :
Reference: BUGTRAQ:20000516 Vuln in calender.pl (Matt Kruse calender
script)
Reference: BID:1215
Reference: XF:http-cgi-calendar-execute
The calender.pl and the calendar_admin.pl calendar scripts by Matt
Kruse allow remote attackers to execute arbitrary commands via shell
metacharacters.
That is correct and it is why we have sids 1536 and 1537. Some scanning
attempts do not spell things quite correctly and do not always use the
correct name for a particular script.
+--------------------------------------------------------------------+
Nigel Houghton Research Engineer Sourcefire Inc.
Vulnerability Research Team
I require a window seat and an inflight Happy Meal, and no pickles!
God help you if I find pickles!
-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
