Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Signatures
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Snort-sigs] FPs for SMTP SSLv3 openssl get shared ciphers overflow atte

from [Russell Fulton] Network Security [Permanent Link]
Subject: [Snort-sigs] FPs for SMTP SSLv3 openssl get shared ciphers overflow attempt sid 8435
Date: Tue, 15 May 2007 09:05:03 +1200
I'm seeing regular FPs for this rule on sessions to our mail server from several different sites.

Russell


META
SID CID TimeStamp Signature Sig ID
6 5890854 2007-05-12 02:32:03 SMTP SSLv3 openssl get shared ciphers overflow attempt 8435
Sensor Hostname Sensor Interface
monitor-dmzo.isec.auckland.ac.nz dmz sensor
IP
Source Address Dest Address Ver Hdr Len TOS length ID flags offset TTL chksum
202.83.76.34 130.216.190.13 4 5 0 130 34926 2 0 111 11180
Resolved Source Resolved Dest
smart-e.com.au harpo.itss.auckland.ac.nz
TCP
Source Port Dest Port Seq Ack Offset Reserved Flags Window Checksum Urgent Ptr
1609 25 1364059628 3379635126 5 0 24 17318 56262 0
Options
None
Flags

RB 1 RB 0 URG ACK PSH RST SYN FIN



X X


DATA 
16030000550100005103

0046447E1DA2E4F42BEB

23C1DEB23AE5A56892CF

ADBCD6DDA774D96786FF

5E077A00002A00160013

000A0066000700050004

00650064006300620061

00600015001200090014

00110008000600030100


            
....U...Q.

.FD~....+.

#...:..h..

.....t.g..

^.z..*....

...f......

.e.d.c.b.a

.`........

..........


            
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [Snort-sigs] FPs for SMTP SSLv3 openssl get shared ciphers overflow attempt sid 8435, Russell Fulton <=
Previous by Date:  [Snort-sigs] Sourcefire VRT Certified Rules Update, Sourcefire VRT
Next by Date:  [Snort-sigs] Problems with rules in web-clients.rules over the last two days, Russell Fulton
Previous by Thread:  [Snort-sigs] Sourcefire VRT Certified Rules Update, Sourcefire VRT
Next by Thread:  [Snort-sigs] Problems with rules in web-clients.rules over the last two days, Russell Fulton
Indexes:  [Date] [Thread] [Top] [All Lists]