[Snort-sigs] New signatures for CAN numbers below

Nigel Houghton nigel at ...435...
Fri Feb 25 08:16:23 EST 2005

On  0, Stephanie Tan <stephanie.tan at ...2420...> allegedly wrote:
> Hi,
> I went through the Snort rules database and the CAN/CVE numbers below
> are not in there (I understand not all exist in there anyways).
> But I was wondering if anyone has created these rules and if so, if
> they could please share them with me?

This one is referenced.

> CAN-2002-0150 

Sids 1768, 1801, 1802, 1803 and 1804

For the others, see if you can cross-reference with bugtraq numbers and
see if those bugtraq numbers show up first. It may be that the cve
number just isn't referenced. Also take a look in the rule docs, we also
put related references in there.

In fact, see if you can cross reference with any other references. Some
of these are quite old, don't forget to check in deleted.rules. Your
best bet is to look in the sid-msg.map for the refs. Don't discount the
possibility that some detection for these issues may now be done in
pre-processors, I can't say which without looking at each reference

> CAN-2002-0020 
> CAN-2001-0509 
> CAN-2001-0508
> CAN-2001-0334 
> CAN-2001-0335 
> CAN-2001-0151 
> CAN-2001-0146 
> CVE-2000-0886
> CVE-2000-0770
> Thanks,
> -Stephanie
     Nigel Houghton      Research Engineer       Sourcefire Inc.
                   Vulnerability Research Team

   Stewie: This is treason.. for God sakes Peter make an example of
   her.. nothing says 'obey me' like a bloody head on a fence post.

More information about the Snort-sigs mailing list