[Snort-users] rule in web-iis.rules causes snort 2.0.0 to die

Crowell, Gary Gary.Crowell at ...4622...
Tue Dec 30 07:54:17 EST 2003


Hi All,

I am running Snort 2.0.0 and the following commented out rule from
web-iis.rules causes snort to die.

	.
	.
####alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS
unicode directory traversal attempt"; flow:to_server,established;
content:"/..%c0%af../"; nocase; classtype:web-application-attack;
reference:cve,CVE-2000-0884; sid:981; rev:6;)
#####^^^^^^
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS
unicode directory traversal attempt"; flow:to_server,established;
content:"/..%c1%1c../"; nocase; classtype:web-application-attack;
reference:cve,CVE-2000-0884; sid:982; rev:6;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-IIS
unicode directory traversal attempt"; flow:to_server,established;
content:"/..%c1%9c../"; nocase; classtype:web-application-attack;
reference:cve,CVE-2000-0884; sid:983; rev:6;)
	.
	.

Very best regards,

gary crowell




More information about the Snort-users mailing list