[Snort-sigs] new rule for detect Battle Carry Dos

Hi,

please check and add this new rule :

dos.rules:alert udp $EXTERNAL_NET any <> $HOME_NET 7000 (msg:"DOS Battle Carry 
attempt";
dsize:>8192;
content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; depth:16;
reference:cve,2005-3493; reference:bugtraq,15282; classtype:attempted-dos; )

'Battle Carry Remote Denial of Service Vulnerability Battle Carry is prone 
to a remote denial of service vulnerability. This issue is due to a failure
in the application to handle exceptional conditions.
An attacker can exploit this vulnerability to crash the application,
ultimately resulting in a denial of service to legitimate users.'

look tethereal view :
 x -> y  UDP Source port: 32818  Destination port: 7000
 x -> y  IP Fragmented IP protocol (proto=UDP 0x11, off=0)
 x -> y  IP Fragmented IP protocol (proto=UDP 0x11, off=1480)
 x -> y  IP Fragmented IP protocol (proto=UDP 0x11, off=2960)
 x -> y  IP Fragmented IP protocol (proto=UDP 0x11, off=4440)
 x -> y  IP Fragmented IP protocol (proto=UDP 0x11, off=5920)

Improve are welcome.

Regards
Rmkml



-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs