[Snort-sigs] ms 03-046 rule

Johnathan Norman jnorman at ...1256...
Mon Nov 10 23:59:05 EST 2003


alert tcp $EXTERNEL_NET any -> $HOME_NET 25 (msg:"EXPLOIT Exchange XEXCH50
overflow (ms03-046)"; content:"XEXCH50 -1"; nocase; flow:to_client,established;classtype:attempted-admin;
rev:1;tag: session, 5, packets; sid:1000035;
reference:url,http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-046.asp)


Johnathan Norman, SCNA,CCSP,ISSP,GCIA
Network Security Analyst
Alert Logic, Inc.
Office: 713-484-8383





More information about the Snort-sigs mailing list