[Snort-sigs] ASN1 question

James Lay jlay at ...3266...
Tue Dec 18 12:53:27 EST 2012


Hey all,

I'm trying to craft a sig that revolves around:

http://seclists.org/fulldisclosure/2012/Apr/210

but I'm not exactly sure on where to start.  I'm guessing that 
asn1:bitstring_overflow 10000 may be the ticket, but I wanted to get 
some input from here.  Any hints on if this is the right way to go?  
Thank you.

James




More information about the Snort-sigs mailing list