[Snort-devel] RE: [snort-cvs] CVS: snort - cazz

Kreimendahl, Chad J Chad.Kreimendahl at ...1167...
Mon Aug 5 13:15:06 EDT 2002


This habbit of not having classifications is almost getting out of hand
:P
All in experimental:

1842,attempted-user ?
1843,attempted-admin ?
1844,attempted-user ?
1845,misc-attack ?
1846,misc-activity ?
1853,attempted-admin ?

-----Original Message-----
From: Brian Caswell [mailto:cazz at ...64...] 
Sent: Monday, August 05, 2002 2:42 PM
To: snort-cvsinfo at lists.sourceforge.net
Subject: [snort-cvs] CVS: snort - cazz


CVSROOT:	/cvsroot/snort
Module name:	snort
Changes by:	cazz at ...1161...	2002/08/05 12:41:48

Modified files:
	etc            : sid sid-msg.map 
	rules          : experimental.rules ftp.rules policy.rules 
	                 web-cgi.rules web-iis.rules web-misc.rules 

Log message:
* updated sid:1630 - added references
* updated sid:560 - updated content to look for multiple versions
* updated sid:837 - added references
* updated sid:890 - added references
* updated sid:1163 - corrected MSG, added references
* updated sid:1076 - moved to web-iis.rules, added references
* updated sid:1016 - added references, updated content to limit false
positives
* updated sid:1043 - added references, re-enabled

* added the following signatures:

1842 || EXPERIMENTAL IMAP login buffer overflow attempt ||
cve,CVE-1999-0005 || nessus,10125
1843 || EXPERIMENTAL BACKDOOR trinity connection attempt ||
cve,CAN-2000-0138 || nessus,10501
1844 || EXPERIMENTAL IMAP authenticate overflow attempt ||
cve,CVE-1999-0042 || nessus,10292
1845 || EXPERIMENTAL IMAP list overflow attempt || cve,CAN-2000-0284 ||
nessus,10374
1846 || EXPERIMENTAL POLICY vnc viewer java applet download attempt ||
nessus,10758
1847 || EXPERIMENTAL WEB-MISC webalizer access || cve,CAN-1999-0643
1848 || WEB-MISC webcart-lite access || nessus,10298 ||
cve,CAN-1999-0610
1849 || WEB-MISC webfind.exe access || nessus,10475 || cve,CAN-2000-0622
1850 || WEB-MISC way-board.cgi access || nessus,10610
1851 || WEB-MISC active.log access || cve,CAN-2000-0642 || nessus,10470
1852 || WEB-MISC robots.txt access || nessus,10302
1853 || EXPERIMENTAL BACKDOOR win-trin00 connection attempt ||
nessus,10307 || cve,CAN-2000-0138



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-cvsinfo mailing list
Snort-cvsinfo at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-cvsinfo




More information about the Snort-devel mailing list