This message is to announce the availability of an update for the
Sourcefire community rule set, which can be downloaded free of cost or
registration from http://www.snort.org/pub-bin/downloads.cgi.
This update fixes a flowbit naming conflict between the BleedingSnort
and Community rule sets by prepending "community_" to the names of all
Community rule flowbits. This string will be present in all future
flowbits used in this ruleset, in order to avoid any further potential
conflicts.
A list of modified rules and their SIDs follows.
Alex Kirk
Community Rules Maintainer
Sourcefire, Inc.
100000240 || COMMUNITY BOT IRC Traffic Detected By Nick Change
100000241 || COMMUNITY BOT Internal IRC server detected
100000242 || COMMUNITY BOT Agobot/PhatBot bot.about command
100000243 || COMMUNITY BOT Agobot/PhatBot bot.die command
100000244 || COMMUNITY BOT Agobot/PhatBot bot.dns command
100000245 || COMMUNITY BOT Agobot/PhatBot bot.execute command
100000246 || COMMUNITY BOT Agobot/PhatBot bot.id command
100000247 || COMMUNITY BOT Agobot/PhatBot bot.nick command
100000248 || COMMUNITY BOT Agobot/PhatBot bot.open command
100000249 || COMMUNITY BOT Agobot/PhatBot bot.remove command
100000250 || COMMUNITY BOT Agobot/PhatBot bot.removeallbut command
100000251 || COMMUNITY BOT Agobot/PhatBot bot.rndnick command
100000252 || COMMUNITY BOT Agobot/PhatBot bot.status command
100000253 || COMMUNITY BOT Agobot/PhatBot bot.sysinfo command
100000254 || COMMUNITY BOT Agobot/PhatBot bot.longuptime command
100000255 || COMMUNITY BOT Agobot/PhatBot bot.highspeed command
100000256 || COMMUNITY BOT Agobot/PhatBot bot.quit command
100000257 || COMMUNITY BOT Agobot/PhatBot bot.flushdns command
100000258 || COMMUNITY BOT Agobot/PhatBot bot.secure command
100000259 || COMMUNITY BOT Agobot/PhatBot bot.unsecure command
100000260 || COMMUNITY BOT Agobot/PhatBot bot.command command
100000261 || COMMUNITY BOT SDBot killthread command
100000262 || COMMUNITY BOT SDBot cdkey command
100000263 || COMMUNITY BOT SDBot getcdkey command
100000264 || COMMUNITY BOT SDBot rndnick command
100000265 || COMMUNITY BOT SDBot c_rndnick command
100000266 || COMMUNITY BOT SDBot c_nick command
100000267 || COMMUNITY BOT SpyBot stopspy command
100000268 || COMMUNITY BOT SpyBot redirectspy command
100000269 || COMMUNITY BOT SpyBot loadclones command
100000270 || COMMUNITY BOT SpyBot killclones command
100000271 || COMMUNITY BOT SpyBot rawclones command
100000272 || COMMUNITY BOT GTBot ver command
100000273 || COMMUNITY BOT GTBot info command
100000274 || COMMUNITY BOT GTBot scan command
100000275 || COMMUNITY BOT GTBot portscan command
100000276 || COMMUNITY BOT GTBot stopscan command
100000277 || COMMUNITY BOT GTBot packet command
100000278 || COMMUNITY BOT GTBot bnc command
100000100 || COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow
Flowbit
100000101 || COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow
Exploit
100000152 || COMMUNITY IMAP MDaemon authentication protocol decode
100000153 || COMMUNITY IMAP MDaemon authentication multiple packet
overflow attempt
100000154 || COMMUNITY IMAP MDaemon authentication okay protocol decode
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
