[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-sigs
Subject:    Re: [Snort-sigs] Sig for MS03-051
From:       Brian <bmc () snort ! org>
Date:       2003-11-17 21:47:14
[Download RAW message or body]

> POST /_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1
> Transfer-Encoding: chunked
> 
> PostLength
> PostData
> 0

Well, we already have a rule that looks for fp30reg.dll.  I'd rather
look for the broken chunked encoding.   I've been offline for the last
3 weeks.  I'll check this in the morning, but its not very high
priority since sid:1248 will catch the publicly available exploits.

-brian


-------------------------------------------------------
This SF. Net email is sponsored by: GoToMyPC
GoToMyPC is the fast, easy and secure way to access your computer from
any Web browser or wireless device. Click here to Try it Free!
https://www.gotomypc.com/tr/OSDN/AW/Q4_2003/t/g22lp?Target=mm/g22lp.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[prev in list] [next in list] [prev in thread] [next in thread]