[Snort-sigs] Re: Snort-sigs digest, Vol 1 #65 - 8 msgs

leE lee at ...105...
Wed Sep 12 00:21:03 EDT 2001


> CodeBlue is when the is a Cardiac Emergency, right? :)
> 
> Since this is a variant, is there any one that has a rule that can tell
> the difference between Blue, Red, or any other color in the spectrum?
> I've not seen the Blue version (this sounds like my daughters PokeMon Versions)
> yet (that I know of, Shadow just creams us with the OC-3 here).

It's easy to discern the two, CodeBlue is not really a variant on
CodeRed at all as it exploits a different hole and has a different
payload ;)

However I've not seen it in the wild to confirm this, or to get a
decent signature :/

The requests you should be looking for exploit ation of 'Web Server
Folder Traversal' (see below link)

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms00-078.asp

Thanks

  Lee

-- 
Lee Brotherston - <lee at ...105...>
http://www.nerds.org.uk




More information about the Snort-sigs mailing list