[Snort-sigs] snort-rules STABLE update @ Tue Jul 1 01:22:21 2003

bmc at ...95... bmc at ...95...
Mon Jun 30 22:23:06 EDT 2003


This rule update was brought to you by Oinkmaster.

[*] Rule modifications: [*]

  [+++]           Added:           [+++]

     file -> smtp.rules
     alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"SMTP Content-Transfer-Encoding overflow attempt"; flow:to_server,established; content:"Content-Transfer-Encoding\:"; byte_test:1,<,256,100,relative; content:!"|0a|"; within:100; reference:cve,CAN-2003-0161; reference:url,www.cert.org/advisories/CA-2003-12.html; classtype:attempted-admin; sid:2183; rev:1;)





More information about the Snort-sigs mailing list