[Snort-sigs] Duplicate reference for sig 2178

Sean Wheeler s.wheeler at ...944...
Sat Apr 3 01:53:04 EST 2004


#SID:2178
#ORIGIN BASE:   alert   tcp     external_net    any     ->      home_net
21
#STAND GROUP:   alert   tcp     any             any     ->      home_net
21
#ALLOC GROUP:   alert   tcp     any             any     ->      $home_net
21
#ORIG SIG:      alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP USER
format string attempt"; flow:to_server,established; content:"USER"; nocase;
pcre:"/^USER\s[^\n]*?%[^\n]*?%/smi"; reference:bugtraq,7474;
reference:bugtraq,9262; reference:bugtraq,9600; reference:bugtraq,7776;
reference:bugtraq,9600; reference:bugtraq,9402; classtype:misc-attack;
sid:2178; rev:7;)
#ORIG SIG clean:332


Duplicate : reference:bugtraq,9600





More information about the Snort-sigs mailing list