CVS: snort - cazz

Brian Caswell <[email protected]> Sun, 18 Apr 2004 13:33:00 -0700
Newsgroups gmane.comp.security.ids.snort.cvs
Message-ID <[email protected]>
CVSROOT:	/cvsroot/snort
Module name:	snort
Changes by:	[email protected]	2004/04/18 13:33:00

Modified files:
	etc            : sid sid-msg.map 
	rules          : attack-responses.rules chat.rules deleted.rules 
	                 dos.rules exploit.rules ftp.rules imap.rules 
	                 misc.rules netbios.rules pop3.rules rpc.rules 
	                 rservices.rules smtp.rules sql.rules tftp.rules 
	                 web-cgi.rules web-client.rules 
	                 web-frontpage.rules web-iis.rules 
	                 web-misc.rules 

Log message:
* a ton of new rules, a bunch of updates too.

2447 || WEB-MISC ServletManager access || cve,CAN-2001-1195 || nessus,12122
2448 || WEB-MISC setinfo.hts access || bugtraq,9973 || nessus,12120
2449 || FTP ALLO overflow attempt || bugtraq,9953
2450 || CHAT Yahoo IM successful logon
2451 || CHAT Yahoo IM voicechat
2452 || CHAT Yahoo IM ping
2453 || CHAT Yahoo IM conference invitation
2454 || CHAT Yahoo IM conference logon success
2455 || CHAT Yahoo IM conference message
2456 || CHAT Yahoo IM file transfer request
2457 || CHAT Yahoo IM message
2458 || CHAT Yahoo IM successful chat join
2459 || CHAT Yahoo IM webcam offer invitation
2460 || CHAT Yahoo IM webcam request
2461 || CHAT Yahoo IM webcam watch
2462 || EXPLOIT IGMP IGAP account overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2463 || EXPLOIT IGMP IGAP message overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2464 || EXPLOIT EIGRP prefix length overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2465 || NETBIOS SMB-DS IPC$ share access
2466 || NETBIOS SMB-DS IPC$ share unicode access
2467 || NETBIOS SMB D$ share unicode access
2468 || NETBIOS SMB-DS D$ share access
2469 || NETBIOS SMB-DS D$ share unicode access
2470 || NETBIOS SMB C$ share unicode access
2471 || NETBIOS SMB-DS C$ share access
2472 || NETBIOS SMB-DS C$ share unicode access
2473 || NETBIOS SMB ADMIN$ share unicode access
2474 || NETBIOS SMB-DS ADMIN$ share access
2475 || NETBIOS SMB-DS ADMIN$ share unicode access
2476 || NETBIOS SMB-DS Create AndX Request winreg attempt
2477 || NETBIOS SMB-DS Create AndX Request winreg unicode attempt
2478 || NETBIOS SMB-DS DCERPC bind winreg attempt
2479 || NETBIOS SMB-DS DCERPC bind winreg unicode attempt
2480 || NETBIOS SMB-DS DCERPC shutdown unicode attempt
2481 || NETBIOS SMB-DS DCERPC shutdown unicode little endian attempt
2482 || NETBIOS SMB-DS DCERPC shutdown attempt
2483 || NETBIOS SMB-DS DCERPC shutdown little endian attempt
2484 || WEB-MISC source.jsp access || nessus,12119
2485 || WEB-CLIENT Nortan antivirus sysmspam.dll load attempt || bugtraq,9916
2486 || DOS ISAKMP invalid identification payload attempt || bugtraq,10004
2487 || SMTP WinZip MIME content-type buffer overflow || bugtraq,9758
2488 || SMTP WinZip MIME content-disposition buffer overflow || bugtraq,9758
2489 || EXPLOIT esignal STREAMQUOTE buffer overflow attempt || bugtraq,9978
2490 || EXPLOIT esignal SNAPQUOTE buffer overflow attempt || bugtraq,9978
2491 || NETBIOS SMB-DS DCERPC ISystemActivator unicode bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2492 || NETBIOS SMB DCERPC ISystemActivator bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2493 || NETBIOS SMB DCERPC ISystemActivator unicode bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2494 || NETBIOS DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2495 || NETBIOS SMB DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2496 || NETBIOS SMB-DS DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2497 || IMAP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2498 || IMAP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2499 || MISC LDAP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2500 || MISC LDAP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2501 || POP3 invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2502 || POP3 invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2503 || SMTP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2504 || SMTP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2505 || WEB-MISC invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2506 || WEB-MISC invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click