[***] Results from Oinkmaster started Sat Nov 26 20:00:08 2005 [***]
[+++] Added rules: [+++]
2002697 - BLEEDING-EDGE EXPLOIT CVSTrac filediff Arbitrary Remote Code
Execution (bleeding-exploit.rules)
2002698 - BLEEDING-EDGE WORM Netsky.P (variant 2) - SMTP incoming
(bleeding-virus.rules)
2002699 - BLEEDING-EDGE VIRUS Win32.Bagle.f (.AH,.AJ,Trojan.Lodear.D) Trojan
Activity - download attempt (bleeding-virus.rules)
2002700 - BLEEDING-EDGE WORM Netsky.P (variant 2) - SMTP outgoing
(bleeding-virus.rules)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (4):
2002697 || BLEEDING-EDGE EXPLOIT CVSTrac filediff Arbitrary Remote Code
Execution || cve,CVE-2004-14562 || bugtraq,10878
2002698 || BLEEDING-EDGE WORM Netsky.P (variant 2) - SMTP incoming ||
url,secunia.com/search/?search=netsky.p
2002699 || BLEEDING-EDGE VIRUS Win32.Bagle.f (.AH,.AJ,Trojan.Lodear.D)
Trojan Activity - download attempt ||
url,www-secure.symantec.com/avcenter/venc/data/trojan.lodear.d.html ||
url,www.trendmicro.com.au/consumer/vinfo/encyclopedia.php?LYstr=VMAINDATA&vNav=3&VName=TROJ_BAGLE.AH
2002700 || BLEEDING-EDGE WORM Netsky.P (variant 2) - SMTP outgoing ||
url,secunia.com/search/?search=netsky.p
-> Added to bleeding-virus.rules (5):
#Submitted by Mark Scott, 2005-11-25
#This trojan is instantiated from the attachment of the Bagel variants
of week 2005-11-20
#The Trojan is Trojan.Lodear.D
#added by Mark Scott 3/22/2004 for Netsky.P, updated 11-24-2005
#submitted by maark Scott, 2005-11-26, Netsky.P - variant 2
[---] Removed non-rule lines: [---]
-> Removed from bleeding-virus.rules (2):
#added by Mark Scott 3/22/2004 for Netsky.P
#added by Mark Scott 3/22/2004 for Netsky.P
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
