[Snort-sigs] Correction to Moreover CGI Shopping Cart Directory Traversal and other new Signatures

Keith Pachulski Keith.Pachulski at ...2...
Tue Oct 10 10:32:31 EDT 2000


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Moreover Web Sigs content was incorrect, was suppose to be
cached_feed.cgi, not shop.cgi
alert tcp !$HOME_NET any -> $HOME_NET 80 (msg:"Moreover CGI Shopping
Cart Directory Traversal" flags:PA; content:"cached_feed.cgi"; 
content:"../";)

- -----

Armada Style Master Index Directory Traversal
alert tcp !$HOME_NET any -> $HOME_NET 80 (msg:"Armada Style Master
Index Directory Traversal"; flags:PA; content:"search.cgi?keys";
content:"catigory=../";)

ICQ Webfront HTTP DoS
alert tcp !$HOME_NET any -> $HOME_NET 80 (msg:"ICQ Webfront HTTP
DoS"; flags:PA; content:"??????????";)

Alair Pro Web Shell Exploit
alert tcp !$HOME_NET any -> $HOME_NET 80 (msg:"Alair Pro Web Shell
Exploit"; flags:PA; content:"authenticate.cgi?PASSWORD";
content:"config.ini";)

Hassan Consulting's Shopping Cart Directory Traversal
alert tcp !$HOME_NET any -> $HOME_NET 80 (msg:"Hassan Consulting's
Shopping Cart Directory Traversal"; flags:PA; content:"shop.cgi";
content:"page=../";)

eXtropia WebStore Directory Traversal Vulnerability
alert tcp !$HOME_NET any -> $HOME_NET 80 (msg:"eXtropia WebStore
Directory Traversal Vulnerability"; flags:PA;
content:"web_store.cgi"; content:"page=../";)

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBOeMpZeGTq6qVSXTQEQItFgCdHT4MvbwBRARggWSs/zmkRWbIST0AoM1/
JOmdYHk+NPiExmHz9ZnNkXPP
=XjfK
-----END PGP SIGNATURE-----



More information about the Snort-sigs mailing list