Re: [Snort-sigs] new rule for detect Vubb Path disclosure

Thanks for all of your contributions this weekend. FYI, they're being 
reviewed for immediate inclusion in a community rulepack.

Alex Kirk
Community Rules Maintainer
Sourcefire, Inc.

> Hi,
>
> please check and add this new rule :
>
> web-php.rules:alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS 
> (msg:"WEB-PHP Vubb Path attempt"; flow:to_server,established; 
> uricontent:"/forum/index.php"; nocase; content:"|26 66 3D 27|"; 
> reference:cve,2005-3513; classtype:web-application-attack; )
>
> This rule detect Path disclosure (not tested).
>
> Improve are welcome.
>
> Regards
> Rmkml
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by:
> Tame your development challenges with Apache's Geronimo App Server. 
> Download
> it for free - -and be entered to win a 42" plasma tv or your very own
> Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs




-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs