Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Signatures
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Snort-sigs] FPs for SMTP ClamAV recipient command injection attempt : 1

from [Russell Fulton] Network Security [Permanent Link]
Subject: [Snort-sigs] FPs for SMTP ClamAV recipient command injection attempt : 12592
Date: Fri, 30 Nov 2007 11:02:35 +1300
Hmmm... There seem to be lots of mailers sending garbage like this that tickles this rule :(

I had 16,000 hits from 1200 different sources.

Russell


META
SID CID TimeStamp Signature Sig ID
6 10582363 2007-11-29 11:16:10 SMTP ClamAV recipient command injection attempt 12592
Sensor Hostname Sensor Interface
monitor-dmzo.isec.auckland.ac.nz dmz sensor
IP
Source Address Dest Address Ver Hdr Len TOS length ID flags offset TTL chksum
199.72.18.130 130.216.190.11 4 5 0 75 63371 2 0 111 63858
Resolved Source Resolved Dest
server.tescopower.com groucho.itss.auckland.ac.nz
TCP
Source Port Dest Port Seq Ack Offset Reserved Flags Window Checksum Urgent Ptr
4400 25 484684468 2761840731 5 0 24 17233 31021 0
Options
None
Flags

RB 1 RB 0 URG ACK PSH RST SYN FIN



X X


DATA 
RCPT TO:<|njl@phy.auckland.ac.nz>..
 
-------------------------------------------------------------------------
SF.Net email is sponsored by: The Future of Linux Business White Paper
from Novell.  From the desktop to the data center, Linux is going
mainstream.  Let it simplify your IT future.
http://altfarm.mediaplex.com/ad/ck/8857-50307-18918-4
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [Snort-sigs] FPs for SMTP ClamAV recipient command injection attempt : 12592, Russell Fulton <=
Previous by Date:  [Snort-sigs] Bleeding Edge Threats Daily Signature Changes, bleeding
Next by Date:  [Snort-sigs] Bleeding Edge Threats Weekly Signature Changes, bleeding
Previous by Thread:  [Snort-sigs] New Project News!, Matt Jonkman
Indexes:  [Date] [Thread] [Top] [All Lists]