[Snort-sigs] Is there a Nachi.b Snort sig?

Nigel Houghton nigel at ...435...
Fri Apr 30 06:11:04 EDT 2004


On  0, Jeffrey Lowe <jeffrey.lowe at ...2440...> allegedly wrote:
> Can't seem to track down a sig for this one, does anybody have a custom out 
> there?

Snort rules exist that identify attempts to exploit the vulnerabilities
that Nachi.b uses to propogate.

For RPC DCOM, look in netbios.rules and for WebDav look in
web-iis.rules and web-misc.rules.

-------------------------------------------------------------
Nigel Houghton  Research Engineer   Sourcefire Inc.
                 Vulnerability Research Team

In an emergency situation involving two or more officers of equal rank,
seniority will be granted to whichever officer can program a vcr.




More information about the Snort-sigs mailing list