[Snort-sigs] Sig for MS03-051

Brian bmc at ...95...
Mon Nov 17 13:48:05 EST 2003


> POST /_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1
> Transfer-Encoding: chunked
> 
> PostLength
> PostData
> 0

Well, we already have a rule that looks for fp30reg.dll.  I'd rather
look for the broken chunked encoding.   I've been offline for the last
3 weeks.  I'll check this in the morning, but its not very high
priority since sid:1248 will catch the publicly available exploits.

-brian




More information about the Snort-sigs mailing list