[prev in list] [next in list] [prev in thread] [next in thread] 

List:       arachnids
Subject:    [arachNIDS] iis5 printer isapi filter signatures
From:       Max Vision <vision () whitehats ! com>
Date:       2001-05-02 21:47:42
[Download RAW message or body]

Hello,

A few new signatures for the .printer ISAPI filter bug.  If anyone gets
ahold of a leaked CMD-spawning exploit please forward.  (I don't need it
for my own use, I need it to see what others will use).  Now would
probably be a good time to add the signatures for signs of outgoing shells
"C:\"  and soforth.

These intrusion events yeild usable signatures for use in Snort 1.7, Snort
1.8, Dragon Sensor, DefenseWorx, and Pakemon.

http://whitehats.com/info/IDS533
http://whitehats.com/info/IDS534

Max

_______________________________________________
arachNIDS mailing list
arachNIDS@whitehats.com
http://whitehats.com/mailman/listinfo/arachnids

[prev in list] [next in list] [prev in thread] [next in thread]