Re: [Snort-sigs] Twiki Exploit rule

On  0, Chas Tomlin <cet@ecs.soton.ac.uk> allegedly wrote:
> http://secunia.com/advisories/16820/
>
>
> alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI
> twiki rev access"; flow:to_server,established;
> uricontent:"/bin/view/Main/TWikiUsers?rev="; nocase;
> classtype:web-application-activity; sid:9999999999999; rev:1;)
 
There's a couple of cleanups to be done to this rule, but if you would
like to submit it for inclusion in the community rules please use the
form at http://www.snort.org/reg-bin/rulesubmit.cgi and we'll make sure
it gets processed. If you have pcaps to support this rule and a doc to
go with it that would help too. 

+--------------------------------------------------------------------+
     Nigel Houghton      Research Engineer       Sourcefire Inc.
                   Vulnerability Research Team

 I require a window seat and an inflight Happy Meal, and no pickles! 
 God help you if I find pickles!


-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs