[Snort-sigs] Wargbot signature

Nigel Houghton nigel at ...435...
Tue Aug 22 14:11:08 EDT 2006


On  0, Sam Evans <wintrmte at ...2420...> wrote:
>    Does  anyone have any signatures for the Wargbot worm already created?
>    If not, I will post some.

According to the information here:

 http://www.symantec.com/security_response/writeup.jsp?docid=2006-081312-3302-99

This worm uses the vulnerability announced in MS06-040 to exploit
machines. Rules do exist to detect attempts to exploit this
vulnerability.

If you think your rules have added value, please feel free to post to
the list or use the submission form at http://www.snort.org/reg-bin/rulesubmit.cgi

+--------------------------------------------------------------------+
     Nigel Houghton      Research Engineer       Sourcefire Inc.
                   Vulnerability Research Team

         There is no theory of evolution, just a list
            of creatures Vin Diesel allows to live.




More information about the Snort-sigs mailing list