[***] Results from Oinkmaster started Thu Sep 29 20:00:12 2005 [***]
[///] Modified active rules: [///]
2000035 - BLEEDING-EDGE Hotmail Inbox Access (bleeding-policy.rules)
2000036 - BLEEDING-EDGE Hotmail Message Access (bleeding-policy.rules)
2000037 - BLEEDING-EDGE Hotmail Compose Message Access (bleeding-policy.rules)
2000494 - BLEEDING-EDGE VIRUS Possible Atak.mm Worm Outbound
(bleeding-virus.rules)
2000561 - BLEEDING-EDGE VIRUS Possible Bagle.AI Worm Outbound
(bleeding-virus.rules)
2001235 - BLEEDING-EDGE MALWARE Weatherbug (bleeding-malware.rules)
2001267 - BLEEDING-EDGE MALWARE Weatherbug Capture (bleeding-malware.rules)
2001292 - BLEEDING-EDGE VIRUS Possible Bagle.AI Worm (bleeding-virus.rules)
2001686 - BLEEDING-EDGE EXPLOIT Awstats Remote Code Execution Attempt
(bleeding-exploit.rules)
2001872 - BLEEDING-EDGE MALWARE Visicom Spyware User Agent
(bleeding-malware.rules)
2002023 - BLEEDING-EDGE TROJAN IRC USER command (bleeding-virus.rules)
2002024 - BLEEDING-EDGE TROJAN IRC NICK command (bleeding-virus.rules)
2002031 - BLEEDING-EDGE TROJAN BOT - potential update/download
(bleeding-virus.rules)
2002364 - BLEEDING-EDGE MALWARE Weatherbug Wxbug Capture
(bleeding-malware.rules)
2002384 - BLEEDING-EDGE TROJAN BOT - potential misc bot commands
(bleeding-virus.rules)
2002386 - BLEEDING-EDGE TROJAN BOT - channel topic misc bot commands
(bleeding-virus.rules)
[///] Modified inactive rules: [///]
2002363 - BLEEDING-EDGE TROJAN BOT - potential reptile commands
(bleeding-virus.rules)
2002370 - BLEEDING-EDGE VIRUS Forbot-FG SMTP Inbound (bleeding-virus.rules)
2002385 - BLEEDING-EDGE TROJAN BOT - channel topic reptile commands
(bleeding-virus.rules)
[---] Disabled rules: [---]
2001255 - BLEEDING-EDGE CHAT Yahoo IM ping (bleeding-policy.rules)
[---] Removed rules: [---]
2001784 - BLEEDING-EDGE EXPLOIT AWStats (awstats_shell) Remote Code Execution
(bleeding-exploit.rules)
2001785 - BLEEDING-EDGE EXPLOIT PHP (allow_url_fopen) File Injection Bug
Feature (bleeding-exploit.rules)
2002328 - BLEEDING-EDGE WEB Remote IIS Server Name spoof attempt (localhost)
(bleeding-web.rules)
2002329 - BLEEDING-EDGE WEB Remote IIS Server Name spoof attempt (127.0.0.1)
(bleeding-web.rules)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-policy.rules (1):
#Commenting out, duplicated in Snort.org set
-> Added to bleeding-sid-msg.map (4):
2001686 || BLEEDING-EDGE EXPLOIT Awstats Remote Code Execution Attempt
|| cve,CAN-2005-0116 || bugtraq,12298 ||
url,www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false
|| url,awstats.sourceforge.net ||
url,www.k-otik.com/exploits/20050302.awstats_shell.c.php ||
url,www.k-otik.com/exploits/20050124.awexpl.c.php
2002370 || BLEEDING-EDGE VIRUS Forbot-FG SMTP Inbound ||
url,www.sophos.com/virusinfo/analyses/w32forbotfg.html
2002385 || BLEEDING-EDGE TROJAN BOT - channel topic reptile commands
2002386 || BLEEDING-EDGE TROJAN BOT - channel topic misc bot commands
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (8):
2001686 || BLEEDING-EDGE EXPLOIT Awstats Remote Code Execution Attempt
|| cve,CAN-2005-0116 || bugtraq,12298 ||
url,www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false
|| url,www.k-otik.com/exploits/20050124.awexpl.c.php
2001784 || BLEEDING-EDGE EXPLOIT AWStats (awstats_shell) Remote Code
Execution || url,awstats.sourceforge.net ||
url,www.k-otik.com/exploits/20050302.awstats_shell.c.php
2001785 || BLEEDING-EDGE EXPLOIT PHP (allow_url_fopen) File Injection
Bug Feature || url,bugs.php.net/bug.php?id=30236
2002328 || BLEEDING-EDGE WEB Remote IIS Server Name spoof attempt
(localhost)
2002329 || BLEEDING-EDGE WEB Remote IIS Server Name spoof attempt
(127.0.0.1)
2002370 || BLEEING-EDGE VIRUS Forbot-FG SMTP Inbound ||
url,www.sophos.com/virusinfo/analyses/w32forbotfg.html
2002385 || BLEEDING-EDGE TROJAN BOT - channel/topic reptile commands
2002386 || BLEEDING-EDGE TROJAN BOT - channel/topic misc bot commands
-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
