[Snort-sigs] sid:853

Chris Green cmg at ...26...
Thu Jan 17 12:35:20 EST 2002


web-cgi.rules:54:alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80
(msg:"WEB-CGI wrap access"; flags: A+;
 uricontent: "/wrap"; reference:bugtraq,373;
 reference:arachnids,234;
 reference:cve,CVE-1999-0149;
 classtype:attempted-recon; sid:853; rev:2;)

change the content to "/wrap?" to minimize false alerts. Wrap is the
proper name of the CGI

-- 
Chris Green <cmg at ...26...>
"I'm beginning to think that my router may be confused."




More information about the Snort-sigs mailing list