Is it possible you could send this + a packet capture of the traffic
to research [at] sourcefire [dot] com?
Thank you!
Joel Esler
SOURCEfire
On Sep 5, 2005, at 5:01 AM, security@information-object.com wrote:
Hello,
This signature exists so I've only included the ID and some info. you
may wish to add.
The blank fields are already filled out on the website.
Pleae let me know if this is OK or not. Thanks.
Rule: SCAN UPnP service discover attempt
--
Sid:
1:1917
--
Summary:
--
Impact:
--
Detailed Information:
--
Affected Systems:
--
Attack Scenarios:
--
Ease of Attack:
--
False Positives:
File sharing software like Bittorrent can trigger this alert.
--
False Negatives:
--
Corrective Action:
Determine if file-sharing is a permited practice, bring awareness to
users of proper file sharing practice.
Unregulated file-sharing may introduce malicious software and use
excessive bandwith.
--
Contributors:
Rudi Starcevic <security@informationobject.com>
--
Additional References:
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server.
Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
