[Snort-users] iis5 printer isapi filter signatures

Max Vision vision at ...4...
Wed May 2 17:47:42 EDT 2001


Hello,

A few new signatures for the .printer ISAPI filter bug.  If anyone gets
ahold of a leaked CMD-spawning exploit please forward.  (I don't need it
for my own use, I need it to see what others will use).  Now would
probably be a good time to add the signatures for signs of outgoing shells
"C:\"  and soforth.

These intrusion events yeild usable signatures for use in Snort 1.7, Snort
1.8, Dragon Sensor, DefenseWorx, and Pakemon.

http://whitehats.com/info/IDS533
http://whitehats.com/info/IDS534

Max





More information about the Snort-users mailing list