[Snort-sigs] Typo in sid 343 (-current)

Andreas Östling andreaso at ...58...
Wed Apr 10 05:16:11 EDT 2002


I believe it should be to_server in this one, not to_client.

alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0 
site exec format string overflow FreeBSD"; flags:A+; flow:to_client; content: 
"|31c0 50 50 50 b07e cd80 31db 31c0|"; depth: 32; reference:arachnids,228;
reference:bugtraq,1387; reference:cve,CAN-2000-0573; 
classtype:attempted-admin; sid:343; rev:3;)

/Andreas




More information about the Snort-sigs mailing list