[Snort-users] possible exploit

Patrick S. Harper patrick at ...4250...
Wed Feb 15 02:24:02 EST 2006


Old Cisco exploit.  I saw a bunch of them not too long ago.

http://isc.sans.org/diary.php?storyid=1104

-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Robert T Wyatt
Sent: Wednesday, February 15, 2006 2:08 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] possible exploit

It's possible that I wasn't logging at the moment this hit, but it did 
not show up in my snort log and so I believe it was missed. I don't know 
what it was after, but it doesn't look friendly to me.

60.10.38.189 - - [14/Feb/2006:22:20:03 -0600] "GET 
/level/16/exec/-///pwd  HTTP/1.0" 404 346 "-" "-"


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users






More information about the Snort-users mailing list