[Snort-sigs] Sig for MS03-051
bmc at ...95...
Mon Nov 17 13:48:05 EST 2003
> POST /_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1
> Transfer-Encoding: chunked
Well, we already have a rule that looks for fp30reg.dll. I'd rather
look for the broken chunked encoding. I've been offline for the last
3 weeks. I'll check this in the morning, but its not very high
priority since sid:1248 will catch the publicly available exploits.
More information about the Snort-sigs