[Snort-sigs] first cut at wu-ftpd sigs

Chris Green cmg at ...26...
Wed Nov 28 13:38:06 EST 2001


alert tcp $EXTERNAL_NET any -> $HOME_NET 21 \
            (msg: "Possible Wu-Ftpd exploit - [ content"; \
             reference: url, \
             "archives.neohapsis.com/archives/vulnwatch/2001-q4/0059.html"; \
             content: "[";)

alert tcp $EXTERNAL_NET any -> $HOME_NET 21 \
            (msg: "Possible Wu-Ftpd exploit - { content"; \
             reference: url, \
             "archives.neohapsis.com/archives/vulnwatch/2001-q4/0059.html"; \
             content: "{";)



-- 
Chris Green <cmg at ...26...>
Let not the sands of time get in your lunch.




More information about the Snort-sigs mailing list