CVS log for snort/rules/deleted.rules

CVS log for snort/rules/deleted.rules
	Help

Up to [cvs] / snort / rules

Request diff between arbitrary revisions

Default branch: MAIN
Bookmark a link to: HEAD / (download)

Revision 1.39 / (view) - annotate - [select for diffs] , Thu Feb 10 01:11:03 2005 UTC (5 years, 1 month ago) by bmc
Branch: MAIN
CVS Tags: HEAD
Changes since 1.38: +0 -0 lines
Diff to previous 1.38

a bunch of new rules.  thanks microsoft, I didn't want to sleep on my birthday.  Really.

Revision 1.38 / (view) - annotate - [select for diffs] , Wed Jan 12 15:46:10 2005 UTC (5 years, 2 months ago) by bmc
Branch: MAIN
Changes since 1.37: +157 -37 lines
Diff to previous 1.37

a bunch of new rules.  go sourcefire.

Revision 1.25.2.2 / (view) - annotate - [select for diffs] , Tue Aug 10 14:01:51 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.25.2.1: +265 -137 lines
Diff to previous 1.25.2.1 to branch point 1.25 to next main 1.26

* massive sync

Revision 1.26.2.6 / (view) - annotate - [select for diffs] , Tue Aug 10 13:59:23 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_1
Changes since 1.26.2.5: +24 -8 lines
Diff to previous 1.26.2.5 to branch point 1.26 to next main 1.27

* massive sync

Revision 1.33.2.2 / (view) - annotate - [select for diffs] , Tue Aug 10 13:52:05 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_2
CVS Tags: SNORT_v2_2_0
Changes since 1.33.2.1: +16 -13 lines
Diff to previous 1.33.2.1 to branch point 1.33 to next main 1.34

* sync sync sync

Revision 1.37 / (view) - annotate - [select for diffs] , Tue Aug 10 13:44:40 2004 UTC (5 years, 7 months ago) by bmc
Branch: MAIN
CVS Tags: STABLE, SNORT_v2_3_0-RC2, SNORT_v2_3_0-RC1, SNORT_v2_3_0, SNORT_2_3
Changes since 1.36: +16 -13 lines
Diff to previous 1.36

* tons of new rules
* tons of new rule references
* tons of new rule docs
* initial documentation on preprocessor alerts (gen-sid.txt in doc/signatures)
* new build of the manual

Revision 1.33.2.1 / (view) - annotate - [select for diffs] , Fri Jul 23 20:19:25 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_2
Changes since 1.33: +31 -2 lines
Diff to previous 1.33

* massive sync here too

Revision 1.36 / (view) - annotate - [select for diffs] , Fri Jul 23 20:15:44 2004 UTC (5 years, 7 months ago) by bmc
Branch: MAIN
Changes since 1.35: +36 -2 lines
Diff to previous 1.35

* sync sync sync
* go ruleteam go

Revision 1.35 / (view) - annotate - [select for diffs] , Thu Jul 15 16:21:28 2004 UTC (5 years, 8 months ago) by bmc
Branch: MAIN
Changes since 1.34: +45 -42 lines
Diff to previous 1.34

* yet another sync, lets go forward in time, not backwards...

Revision 1.34 / (view) - annotate - [select for diffs] , Wed Jul 14 21:16:09 2004 UTC (5 years, 8 months ago) by bmc
Branch: MAIN
Changes since 1.33: +42 -50 lines
Diff to previous 1.33

* massive rule updates (go ruleteam, go)

Revision 1.33 / (view) - annotate - [select for diffs] , Mon Jun 28 17:49:44 2004 UTC (5 years, 8 months ago) by bmc
Branch: MAIN
CVS Tags: SNORT_v2_2_0-RC1
Branch point for: SNORT_2_2
Changes since 1.32: +6 -1 lines
Diff to previous 1.32

* asn1 rule goodness (Big massive round of applause to Dan for the ASN1 plugin)

Revision 1.26.2.5 / (view) - annotate - [select for diffs] , Wed Jun 16 15:11:06 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: SNORT_2_1
Changes since 1.26.2.4: +42 -41 lines
Diff to previous 1.26.2.4 to branch point 1.26

* Syncing changes for rules team

Revision 1.32 / (view) - annotate - [select for diffs] , Tue Jun 15 13:47:07 2004 UTC (5 years, 9 months ago) by bmc
Branch: MAIN
Changes since 1.31: +45 -42 lines
Diff to previous 1.31

* lets try this *again*

Revision 1.31 / (view) - annotate - [select for diffs] , Thu Jun 3 20:11:04 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: MAIN
Changes since 1.30: +252 -238 lines
Diff to previous 1.30

* sync with sforge current

Revision 1.26.2.4 / (view) - annotate - [select for diffs] , Thu Jun 3 18:13:37 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: SNORT_2_1
CVS Tags: SNORT_v2_1_3
Changes since 1.26.2.3: +244 -160 lines
Diff to previous 1.26.2.3 to branch point 1.26

* updating 2.1.3 from sforge

Revision 1.26.2.3 / (view) - annotate - [select for diffs] , Fri May 28 19:21:40 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: SNORT_2_1
Changes since 1.26.2.2: +11 -4 lines
Diff to previous 1.26.2.2 to branch point 1.26

* syncing up sfire with sforge 2.1 branch

Revision 1.30 / (view) - annotate - [select for diffs] , Sun Apr 18 20:32:58 2004 UTC (5 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.29: +13 -4 lines
Diff to previous 1.29

* a ton of new rules, a bunch of updates too.

2447 || WEB-MISC ServletManager access || cve,CAN-2001-1195 || nessus,12122
2448 || WEB-MISC setinfo.hts access || bugtraq,9973 || nessus,12120
2449 || FTP ALLO overflow attempt || bugtraq,9953
2450 || CHAT Yahoo IM successful logon
2451 || CHAT Yahoo IM voicechat
2452 || CHAT Yahoo IM ping
2453 || CHAT Yahoo IM conference invitation
2454 || CHAT Yahoo IM conference logon success
2455 || CHAT Yahoo IM conference message
2456 || CHAT Yahoo IM file transfer request
2457 || CHAT Yahoo IM message
2458 || CHAT Yahoo IM successful chat join
2459 || CHAT Yahoo IM webcam offer invitation
2460 || CHAT Yahoo IM webcam request
2461 || CHAT Yahoo IM webcam watch
2462 || EXPLOIT IGMP IGAP account overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2463 || EXPLOIT IGMP IGAP message overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2464 || EXPLOIT EIGRP prefix length overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2465 || NETBIOS SMB-DS IPC$ share access
2466 || NETBIOS SMB-DS IPC$ share unicode access
2467 || NETBIOS SMB D$ share unicode access
2468 || NETBIOS SMB-DS D$ share access
2469 || NETBIOS SMB-DS D$ share unicode access
2470 || NETBIOS SMB C$ share unicode access
2471 || NETBIOS SMB-DS C$ share access
2472 || NETBIOS SMB-DS C$ share unicode access
2473 || NETBIOS SMB ADMIN$ share unicode access
2474 || NETBIOS SMB-DS ADMIN$ share access
2475 || NETBIOS SMB-DS ADMIN$ share unicode access
2476 || NETBIOS SMB-DS Create AndX Request winreg attempt
2477 || NETBIOS SMB-DS Create AndX Request winreg unicode attempt
2478 || NETBIOS SMB-DS DCERPC bind winreg attempt
2479 || NETBIOS SMB-DS DCERPC bind winreg unicode attempt
2480 || NETBIOS SMB-DS DCERPC shutdown unicode attempt
2481 || NETBIOS SMB-DS DCERPC shutdown unicode little endian attempt
2482 || NETBIOS SMB-DS DCERPC shutdown attempt
2483 || NETBIOS SMB-DS DCERPC shutdown little endian attempt
2484 || WEB-MISC source.jsp access || nessus,12119
2485 || WEB-CLIENT Nortan antivirus sysmspam.dll load attempt || bugtraq,9916
2486 || DOS ISAKMP invalid identification payload attempt || bugtraq,10004
2487 || SMTP WinZip MIME content-type buffer overflow || bugtraq,9758
2488 || SMTP WinZip MIME content-disposition buffer overflow || bugtraq,9758
2489 || EXPLOIT esignal STREAMQUOTE buffer overflow attempt || bugtraq,9978
2490 || EXPLOIT esignal SNAPQUOTE buffer overflow attempt || bugtraq,9978
2491 || NETBIOS SMB-DS DCERPC ISystemActivator unicode bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2492 || NETBIOS SMB DCERPC ISystemActivator bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2493 || NETBIOS SMB DCERPC ISystemActivator unicode bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2494 || NETBIOS DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2495 || NETBIOS SMB DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2496 || NETBIOS SMB-DS DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2497 || IMAP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2498 || IMAP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2499 || MISC LDAP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2500 || MISC LDAP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2501 || POP3 invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2502 || POP3 invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2503 || SMTP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2504 || SMTP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2505 || WEB-MISC invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2506 || WEB-MISC invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120

Revision 1.25.2.1 / (view) - annotate - [select for diffs] , Mon Mar 22 16:26:30 2004 UTC (5 years, 11 months ago) by cazz
Branch: SNORT_2_0
Changes since 1.25: +10 -2 lines
Diff to previous 1.25

* sync sync sync

Revision 1.26.2.2 / (view) - annotate - [select for diffs] , Mon Mar 22 16:18:34 2004 UTC (5 years, 11 months ago) by cazz
Branch: SNORT_2_1
CVS Tags: SNORT_v2_1_3-RC1, SNORT_v2_1_2
Changes since 1.26.2.1: +26 -1 lines
Diff to previous 1.26.2.1 to branch point 1.26

* sync sync sync

Revision 1.29 / (view) - annotate - [select for diffs] , Sat Mar 20 21:58:42 2004 UTC (6 years ago) by cazz
Branch: MAIN
Changes since 1.28: +24 -2 lines
Diff to previous 1.28

* Added a ton of rules that include vulnerabilities in many high-profile
  security products, including Checkpoint & ISS gear (see below)
* provided a single high-powered rule for detecting all of the evil virus emails
* added even more docs.  (Go Nigel)

2405 || WEB-PHP phptest.php access || bugtraq,9737
2406 || TELNET APC SmartSlot default admin account attempt || bugtraq,9681
2407 || WEB-MISC util.pl access || bugtraq,9748
2408 || WEB-MISC Invision Power Board search.pl access || bugtraq,9766
2409 || POP3 APOP USER overflow attempt || bugtraq,9794
2410 || WEB-PHP IGeneric Free Shopping Cart page.php access || bugtraq,9773
2411 || WEB-MISC Real Server DESCRIBE buffer overflow attempt || url,www.service.real.com/help/faq/security/rootexploit091103.html || bugtraq,8476
2412 || ATTACK-RESPONSES successful cross site scripting forced download attempt
2413 || EXPLOIT ISAKMP delete hash with empty hash attempt || bugtraq,9416 || bugtraq,CAN-2004-0164
2414 || EXPLOIT ISAKMP initial contact notification without SPI attempt || bugtraq,9416 || bugtraq,CAN-2004-0164
2415 || EXPLOIT ISAKMP second payload initial contact notification without SPI attempt || bugtraq,9416 || bugtraq,CAN-2004-0164
2416 || FTP invalid MDTM command attempt
2417 || FTP format string attempt
2418 || MISC MS Terminal Server no encryption session initiation attmept || url,www.microsoft.com/technet/security/bulletin/MS01-052.asp
2419 || MULTIMEDIA realplayer .ram playlist download attempt
2420 || MULTIMEDIA realplayer .rmp playlist download attempt
2421 || MULTIMEDIA realplayer .smi playlist download attempt
2422 || MULTIMEDIA realplayer .rt playlist download attempt
2423 || MULTIMEDIA realplayer .rp playlist download attempt
2424 || NNTP sendsys overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2425 || NNTP senduuname overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2426 || NNTP version overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2427 || NNTP checkgroups overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2428 || NNTP ihave overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2429 || NNTP sendme overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2430 || NNTP newgroup overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2431 || NNTP rmgroup overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2432 || NNTP article post without path attempt
2433 || WEB-CGI MDaemon form2raw.cgi overflow attempt || bugtraq,9317
2434 || WEB-CGI MDaemon form2raw.cgi access || bugtraq,9317
2435 || WEB-CLIENT Microsoft emf metafile access || bugtraq,9707
2436 || WEB-CLIENT Microsoft wmf metafile access || bugtraq,9707
2437 || WEB-CLIENT RealPlayer arbitrary javascript command attempt || bugtraq,8453 || bugtraq,9738 || cve,CAN-2003-0726
2438 || WEB-CLIENT RealPlayer playlist file URL overflow attempt || bugtraq,9579
2439 || WEB-CLIENT RealPlayer playlist http URL overflow attempt || bugtraq,9579
2440 || WEB-CLIENT RealPlayer playlist rtsp URL overflow attempt || bugtraq,9579
2441 || WEB-MISC NetObserve authentication bypass attempt || bugtraq,9319
2442 || WEB-MISC Quicktime User-Agent buffer overflow attempt || cve,CAN-2004-0169
2443 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
2444 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
2445 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER last name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
2446 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER email overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html

Revision 1.28 / (view) - annotate - [select for diffs] , Fri Feb 27 22:36:18 2004 UTC (6 years ago) by cazz
Branch: MAIN
Changes since 1.27: +16 -1 lines
Diff to previous 1.27

* 44 new rules, 52 updates.   see snort-sigs mailing list in a few days for the full details.

The cool rules are:
(For ISS buffer overflow detection!)
NETBIOS SMB Session Setup AndX request username overflow attempt
NETBIOS SMB Data Service Session Setup AndX request username overflow attempt
NETBIOS SMB Session Setup AndX request unicode username overflow attempt
NETBIOS SMB Data Service Session Setup AndX request unicode username overflow attempt

(For FW1 ISAKMP buffer overflow detection!)
EXPLOIT ISAKMP first payload certificate request length overflow attempt
EXPLOIT ISAKMP second payload certificate request length overflow attempt
EXPLOIT ISAKMP third payload certificate request length overflow attempt
EXPLOIT ISAKMP forth payload certificate request length overflow attempt
EXPLOIT ISAKMP fifth payload certificate request length overflow attempt

Revision 1.26.2.1 / (view) - annotate - [select for diffs] , Wed Feb 25 16:52:51 2004 UTC (6 years ago) by jh8
Branch: SNORT_2_1
CVS Tags: SNORT_v2_1_1
Changes since 1.26: +7 -2 lines
Diff to previous 1.26

* Bringing RC1 up to 2.1.1

Revision 1.27 / (view) - annotate - [select for diffs] , Fri Feb 20 17:16:35 2004 UTC (6 years ago) by cazz
Branch: MAIN
Changes since 1.26: +7 -2 lines
Diff to previous 1.26

* bunch o bunch o updates

Revision 1.26 / (view) - annotate - [select for diffs] , Mon Oct 20 15:03:05 2003 UTC (6 years, 5 months ago) by chrisgreen
Branch: MAIN
CVS Tags: version-2-1-0, cmg, SNORT_v2_1_1-RC1, SNORT_v2_1_0
Branch point for: SNORT_2_1
Changes since 1.25: +1 -1 lines
Diff to previous 1.25

* Major add/commit of 2.1 feature set...

  Will do a tag and then remove the "moved" files

Revision 1.25 / (view) - annotate - [select for diffs] , Mon Jun 9 13:25:32 2003 UTC (6 years, 9 months ago) by cazz
Branch: MAIN
CVS Tags: version-2-0-6, version-2-0-5, version-2-0-2, version-2-0-1
Branch point for: SNORT_2_0
Changes since 1.24: +1 -6 lines
Diff to previous 1.24

* remove some dups (thanks to Andreas for pointing them out)

Revision 1.24 / (view) - annotate - [select for diffs] , Sun Jun 8 07:27:37 2003 UTC (6 years, 9 months ago) by cazz
Branch: MAIN
Changes since 1.23: +90 -1 lines
Diff to previous 1.23

* delete sid:1298 - dup of 588
* delete sid:1299 - dup of 1274
* delete sid:720,722,723,724,725,727,726,728,731,733,734,735,736,737,738,735,736,737,737,738,739,740,741,742,743,744,745,746,748,747,749,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,781,783,784,785,786,787,788,790,791,792,794,795,796,797,798,799 800 801,789,1800 - these virus rules suck.

* update sid:721 - update to not suck
* update sid:730 - update to not suck
* update sid:793 - update to not suck
* update sid:729 - update to not suck

* add sid:2160 - VIRUS OUTBOUND .exe file attachment
* add sid:2161 - VIRUS OUTBOUND .doc file attachment
* add sid:2162 - VIRUS OUTBOUND .hta file attachment
* add sid:2163 - VIRUS OUTBOUND .chm file attachment
* add sid:2164 - VIRUS OUTBOUND .reg file attachment
* add sid:2165 - VIRUS OUTBOUND .ini file attachment
* add sid:2166 - VIRUS OUTBOUND .bat file attachment
* add sid:2167 - VIRUS OUTBOUND .diz file attachment
* add sid:2168 - VIRUS OUTBOUND .cpp file attachment
* add sid:2169 - VIRUS OUTBOUND .dll file attachment
* add sid:2170 - VIRUS OUTBOUND .vxd file attachment
* add sid:2171 - VIRUS OUTBOUND .sys file attachment
* add sid:2172 - VIRUS OUTBOUND .com file attachment
* add sid:2173 - VIRUS OUTBOUND .hsq file attachment

Revision 1.23 / (view) - annotate - [select for diffs] , Wed May 14 18:07:56 2003 UTC (6 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.22: +21 -3 lines
Diff to previous 1.22

* major push of rules.  see snort-sigs email for all the changes.

Revision 1.22 / (view) - annotate - [select for diffs] , Thu Apr 17 00:35:46 2003 UTC (6 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.21: +51 -7 lines
Diff to previous 1.21

* MASSIVE sync of rules

This is the first major sync of rules since I started working for Sourcefire.

Many of these updates are a direct result of my employment at Sourcefire.  We
have time and resources to test and document rules extensively.  Many people
have contributed to these updates.  Too many to mention here.

You should continue to see awesome updates, rewrites and new rules as
Sourcefire is dedicating serious resources to the Snort project.

Even if you don't buy an appliance from Sourcefire, you should send an
email to info@sourcefire.com to let them know how much you appreciate their
dedication to making snort awesome.

Revision 1.14.2.2 / (view) - annotate - [select for diffs] , Sun Feb 9 03:27:29 2003 UTC (7 years, 1 month ago) by cazz
Branch: SNORT_1_9
CVS Tags: version-1-9-1
Changes since 1.14.2.1: +109 -1 lines
Diff to previous 1.14.2.1 to branch point 1.14 to next main 1.15

* merge the rest of the changes from current.

Most of this done thanks to the large efforts from Frank Knobbe and
Russell Fulton (at least, I think its Fulton :P)

Thanks guys.  (Oh, anyone reading these, send them an email thanking them
for their efforts.)

Revision 1.21 / (view) - annotate - [select for diffs] , Sun Jan 26 02:16:39 2003 UTC (7 years, 1 month ago) by cazz
Branch: MAIN
CVS Tags: version-2-0-0, CMG
Changes since 1.20: +18 -1 lines
Diff to previous 1.20

* move some policy rules to policy.rules
* move some deleted rules to deleted.rules
* add sid:2003 - rule for the Slammer worm (MS SQL Buff overflow #30052342)

Revision 1.20 / (view) - annotate - [select for diffs] , Wed Jan 22 02:35:09 2003 UTC (7 years, 1 month ago) by cazz
Branch: MAIN
Changes since 1.19: +84 -1 lines
Diff to previous 1.19

* wee.  new rules.  check snort-sigs in a bit for the changes

Revision 1.19 / (view) - annotate - [select for diffs] , Mon Nov 25 01:58:12 2002 UTC (7 years, 3 months ago) by cazz
Branch: MAIN
Changes since 1.18: +9 -1 lines
Diff to previous 1.18

* updated sid:107 - corrected bad content checks
* updated sid:159 - corrected client/server pair
* updated sid:195 - corrected client/server pair
* updated sid:1929 - (trust me, it changed between 1,2 and 3)
* updated sid:524 - removed invalid references
* updated sid:238 - corrected client/server pair
* updated sid:1257 - added additional ports that can be targetted
* updated sid:306 - added reference
* updated sid:1919 - added references
* updated sid:1734 - added references
* updated sid:361 - added distance to limit false positives
* updated sid:362 - removed RETR content check (can be used with STOR as well)
* updated sid:1377 - added distance to limit false positives
* updated sid:1378 - added distance to limit false positives
* re-enabled sid:1748 - should be on by default
* updated sid:1844 - use byte_test instead of distance
* updated sid:1845 - use byte_test instead of distance
* updated sid:1903 - remove additional un-needed content
* updated sid:1755 - use within
* disabled sid:293 - replaced with other sids
* disabled sid:295 - replaced with other sids
* disabled sid:296 - replaced with other sids
* disabled sid:297 - replaced with other sids
* disabled sid:298 - replaced with other sids
* disabled sid:299 - replaced with other sids
* updated sid:489 - added within
* updated sid:1866 - added references
* disabled sid:570 - replaced with other sids
* disabled sid:571 - replaced with other sids
* updated sid:664 - updated MSG to be more clear
* updated sid:1289 - added offsets
* updated sid:1441 - added offsets
* updated sid:1442 - added offsets
* updated sid:1443 - added offsets
* updated sid:519 - added offsets
* updated sid:1149 - updated MSG to be more clear
* disabled sid:1287 - too false positive to be on by default
* updated sid:1069 - updated MSG to be more clear
* updated sid:1519 - updated MSG to be correct, update content to be correct
* updated sid:1809 - use HTTP_PORTS instead of 80
* updated sid:1826 - correct uricontent
* disabled sid:1171 - too false positive to be on by default

* deleted sid:874 - very bad rule
* deleted sid:318 - replaced by sid:1939 and sid:1940
* deleted sid:319 - replaced by sid:1939 and sid:1940

* reordered rpc.rules to be a bit more clear
* reordered dns.rules to be a bit more clear
* added pop2.rules
* disaabled asn1_decode, as it shouldn't be on by default
* added the following rules:
1929 || BACKDOOR TCPDUMP/PCAP trojan traffic || url,hlug.fscker.com
1930 || IMAP auth overflow attempt || cve,CVE-1999-0005
1931 || WEB-CGI rpc-nlog.pl access || cve,CAN-1999-1278
1932 || WEB-CGI rpc-smb.pl access || cve,CAN-1999-1278
1933 || WEB-CGI cart.cgi access
1934 || POP2 FOLD overflow attempt || cve,CVE-1999-0920 || bugtraq,283
1935 || POP2 FOLD arbitrary file attempt
1936 || POP3 AUTH overflow attempt
1937 || POP3 LIST overflow attempt || cve,CAN-2000-0096 || bugtraq,948
1938 || POP3 XTND overflow attempt
1939 || MISC bootp hardware address lenght overflow || cve,CAN-1999-0798
1940 || MISC bootp invalid hardware type || cve,CAN-1999-0798
1941 || TFTP filename overflow attempt || bugtraq,5328 || cve,CAN-2002-0813
1942 || FTP RMDIR overflow attempt
1943 || WEB-MISC /Carello/add.exe access || bugtraq,1245 || cve,CVE-2000-0396
1944 || WEB-MISC /ecscripts/ecware.exe access
1945 || WEB-IIS unicode directory traversal attempt || cve,CVE-2000-0884
1946 || WEB-MISC answerbook2 admin attempt
1947 || WEB-MISC answerbook2 arbitrary command execution attempt
1948 || DNS zone transfer UDP || arachnids,212 || cve,CAN-1999-0532
1949 || RPC portmap SET attempt TCP 111
1950 || RPC portmap SET attempt UDP 111
1951 || RPC mountd TCP mount request
1952 || RPC mountd UDP export request
1953 || RPC AMD TCP pid request
1954 || RPC AMD UDP pid request
1955 || RPC AMD TCP version request
1956 || RPC AMD UDP version request
1957 || RPC sadmind UDP PING || bugtraq,866
1958 || RPC sadmind TCP PING || bugtraq,866
1959 || RPC portmap request NFS UDP
1960 || RPC portmap request NFS TCP
1961 || RPC portmap request RQUOTA UDP
1962 || RPC portmap request RQUOTA TCP
1963 || RPC RQUOTA UDP getquota overflow attempt || bugtraq,864 || cve,CVE-1999-0974
1964 || RPC tooltalk UDP overflow attempt
1965 || RPC tooltalk TCP overflow attempt
1966 || MISC GlobalSunTech Access Point Information Discolsure attempt || bugtraq,6100
1967 || WEB-PHP phpbb quick-reply.php arbitrary command attempt || bugtraq,6173
1968 || WEB-PHP phpbb quick-reply.php access || bugtraq,6173
1969 || WEB-MISC ion-p access || bugtraq,6091
1970 || WEB-IIS MDAC Content-Type overflow attempt
1971 || FTP SITE EXEC format string attempt
1972 || FTP PASS overflow attempt || cve,CAN-2002-0126 || cve,CAN-2000-1035
1973 || FTP MKD overflow attempt || bugtraq,612 || cve,CAN-1999-0911
1974 || FTP REST overflow attempt || cve,CAN-2001-0826
1975 || FTP DELE overflow attempt || cve,CAN-2001-0826
1976 || FTP RMD overflow attempt || cve,CAN-2001-0826
1977 || WEB-MISC xp_regwrite attempt
1978 || WEB-MISC xp_regdeletekey attempt
1979 || WEB-MISC perl post attempt || nessus,11158 || bugtraq,5520

Revision 1.14.2.1 / (view) - annotate - [select for diffs] , Sun Nov 17 04:40:08 2002 UTC (7 years, 4 months ago) by cazz
Branch: SNORT_1_9
Changes since 1.14: +37 -16 lines
Diff to previous 1.14

* major sync from current (look ma, no experimental.rules)
* added pop2.rules
* regen sid-msg.map

Revision 1.18 / (view) - annotate - [select for diffs] , Wed Nov 6 15:42:29 2002 UTC (7 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.17: +22 -22 lines
Diff to previous 1.17

* bump the rev of all the deleted rules

Revision 1.17 / (view) - annotate - [select for diffs] , Wed Nov 6 13:35:14 2002 UTC (7 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.16: +3 -1 lines
Diff to previous 1.16

* add my notes to RULES.todo
* delete sid:1620 - spp_conversation takes care of this
* moved sid:1429,1447,1448,1545,1636,1641,1771,1791,1801,1802,1803,1804,1808,
  1810,1811,1812,1819,1821,1832,1838,1842,1843,1844,1845,1902,1903,1904,1846,
  1853,1854,1855,1856,1865,1888,1887,1889,1905,1906,1907,1908,1909,1910,1911,
  1912,1480,1913,1914,1915,1916,1917,1918 to their final resting place.

This marks the end of experimental.rules.  Please take a moment of silence.

Revision 1.16 / (view) - annotate - [select for diffs] , Tue Nov 5 21:40:51 2002 UTC (7 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.15: +1 -11 lines
Diff to previous 1.15

* re-enable sid:1104,1087,1171 - these don't need to be deleted

Revision 1.15 / (view) - annotate - [select for diffs] , Tue Nov 5 21:01:56 2002 UTC (7 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.14: +30 -1 lines
Diff to previous 1.14

* updated sid:1382 - removed dsize, added within
* deleted sid:329 - duplicate of 330
* deleted sid:1477 - duplicate of 1478
* deleted sid:1246 - duplicate of 1248
* deleted sid:1247 - duplicate of 1249
* deleted sid:1171 - broken because of stream reassembly, needs added to httpd decoder
* deleted sid:1104 - broken because of stream reassembly, needs added to httpd decoder
* deleted sid:1087 - broken because of stream reassembly, needs added to httpd decoder
* deleted sid:1780 - duplicate of 1755
* deleted sid:291 - duplicate of 1538
* updated sid:1842 - removed dsize, added within
* updated sid:337 - updated msg, removed dsize, added within
* updated sid:1377 - added CVE references
* updated sid:1378 - added CVE references
* updated sid:1379 - removed dsize, added within
* updated sid:1621 - removed dsize, added within
* updated sid:1529 - removed dsize, added within
* updated sid:1630 - removed dsize, added within
* updated sid:1562 - removed dsize, added within
* updated sid:1734 - removed dsize, added within
* updated sid:1755 - added CVE reference, added within
* updated sid:1388 - removed dsize, added within
* updated sid:1792 - added CVE reference, removed dsize, added within
* updated sid:1538 - added arachnids reference, removed dsize, added within
* updated sid:1866 - removed dsize, added within
* updated sid:1634 - removed dsize, added within
* updated sid:1635 - removed dsize, added within
* disabled sid:596 - soon to be replaced by other rules
* disabled sid:597 - soon to be replaced by other rules
* updated sid:1280 - added within to skip revisions (evasion protection)
* updated sid:598 - added within to skip revisions (evasion protection)
* updated sid:599 - added within to skip revisions (evasion protection)
* updated sid:1281 - added within to skip revisions (evasion protection)
* disabled sid:600 - soon to be replaced by other rules
* disabled sid:1282 - soon to be replaced by other rules
* updated sid:654 - removed dsize, added within
* updated sid:657 - removed dsize, added within
* updated sid:1549 - removed dsize, added within
* updated sid:1550 - removed dsize, added within
* updated sid:804 - removed dsize
* updated sid:821 - removed dsize
* updated sid:1242 - removed dsize
* updated sid:1244 - removed dsize
* updated sid:981:
  - removed "/scripts", attackers can use other directories
  - s/uricontent/content/ (http decoder decodes uricontent, we don't want to
    look at the decoded portion)
* updated sid:982:
  - removed "/scripts", attackers can use other directories
  - s/uricontent/content/ (http decoder decodes uricontent, we don't want to
    look at the decoded portion)
* updated sid:983:
  - removed "/scripts", attackers can use other directories
  - s/uricontent/content/ (http decoder decodes uricontent, we don't want to
    look at the decoded portion)
* updated sid:1044 - removed dsize
* updated sid:1181 - removed dsize
* updated sid:1258 - removed dsize
* updated sid:1260 - removed dsize, added within
* added the following rules:
1902 || EXPERIMENTAL IMAP lsub overflow attempt || cve,CAN-2000-0284 || nessus,10374
1903 || EXPERIMENTAL IMAP rename overflow attempt || cve,CAN-2000-0284 || nessus,10374
1904 || EXPERIMENTAL IMAP find overflow attempt || cve,CAN-2000-0284 || nessus,10374
1905 || RPC AMD UDP amqproc_mount plog overflow attempt || bugtraq,614 || cve,CVE-1999-0704
1906 || RPC AMD TCP amqproc_mount plog overflow attempt || bugtraq,614 || cve,CVE-1999-0704
1907 || RPC CMSD UDP CMSD_CREATE buffer overflow attempt || bugtraq,524 || cve,CVE-1999-0696
1908 || RPC CMSD TCP CMSD_CREATE buffer overflow attempt || bugtraq,524 || cve,CVE-1999-0696
1909 || RPC CMSD TCP CMSD_INSERT buffer overflow attempt || url,www.cert.org/advisories/CA-99-08-cmsd.html || cve,CVE-1999-0696
1910 || RPC CMSD udp CMSD_INSERT buffer overflow attempt || url,www.cert.org/advisories/CA-99-08-cmsd.html || cve,CVE-1999-0696
1911 || RPC sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt || bugtraq,866 || cve,CVE-1999-0977
1912 || RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt || bugtraq,866 || cve,CVE-1999-0977
1913 || RPC STATD UDP stat mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1914 || RPC STATD TCP stat mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1915 || RPC STATD UDP monitor mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1916 || RPC STATD TCP monitor mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1917 || SCAN UPNP service discover attempt
1918 || SCAN SolarWinds IP scan attempt
1919 || FTP CWD overflow attempt
1920 || FTP SITE NEWER overflow attempt || cve,CVE-1999-0800
1921 || FTP SITE ZIPCHK attempt || cve,CVE-2000-0040
1922 || RPC portmap TCP proxy attempt
1923 || RPC portmap UDP proxy attempt

Revision 1.14 / (view) - annotate - [select for diffs] , Sun Aug 18 20:28:43 2002 UTC (7 years, 7 months ago) by cazz
Branch: MAIN
CVS Tags: version-1-9-0
Branch point for: SNORT_1_9
Changes since 1.13: +3 -2 lines
Diff to previous 1.13

* large update of signatures.  CVS disconnected during the last commit, so
  this is a recommit

Revision 1.13 / (view) - annotate - [select for diffs] , Wed Jul 31 18:12:49 2002 UTC (7 years, 7 months ago) by cazz
Branch: MAIN
CVS Tags: beta-1_9_0-beta6, beta-1_9_0-beta5, beta-1_9_0-beta4, beta-1_9_0-beta2
Changes since 1.12: +2 -2 lines
Diff to previous 1.12

* our example output files should not conflict
* updated sid:325 - yes, its deleted.  that doesn't mean it should be broken
* updated sid:1792 - added depth:4

* added the following signatures:
1836 || PORN alt.binaries.pictures.erotica
1837 || PORN alt.binaries.pictures.tinygirls
1838 || EXPERIMENTAL SSH server banner overflow || bugtraq,5287
1839 || EXPERIMENTAL WEB-MISC mailman cross site scripting attempt || bugtraq,5298
1840 || EXPERIMENTAL WEB-CLIENT javascript document.domain attempt || bugtraq,5346
1841 || EXPERIMENTAL WEB-CLIENT javascript URL host spoofing attempt || bugtraq,5293

Revision 1.12 / (view) - annotate - [select for diffs] , Fri Jun 28 13:59:37 2002 UTC (7 years, 8 months ago) by cazz
Branch: MAIN
Changes since 1.11: +4 -1 lines
Diff to previous 1.11

* deleted sid:1227 - yeah, port based only sigs suck
* updated sid:1379,1621,1529,1630,1562,1734 - added "no_stream" since these
  false alarm often since chrs fixed stream4 injection

Revision 1.11 / (view) - annotate - [select for diffs] , Fri Jun 14 22:21:15 2002 UTC (7 years, 9 months ago) by cazz
Branch: MAIN
Changes since 1.10: +5 -5 lines
Diff to previous 1.10

* deleted sid:1698 - deleted duplicate signature
* updated sid:1768 - cleaned up deleted sig
* updated sid:1801,1802,1803,1804 - cleaned up msg

Revision 1.10 / (view) - annotate - [select for diffs] , Thu Jun 13 13:30:44 2002 UTC (7 years, 9 months ago) by cazz
Branch: MAIN
Changes since 1.9: +6 -1 lines
Diff to previous 1.9

* deleted sid:1768 - replaced by 1801, 1802, 1803, and 1804
* added the following signatures:
1801 || EXPERIMENTAL WEB-IIS Buffer Overrun in HTTP header handling || bugtraq,
4476
1802 || EXPERIMENTAL WEB-IIS Buffer Overrun in HTTP header handling || bugtraq,4476
1803 || EXPERIMENTAL WEB-IIS Buffer Overrun in HTTP header handling || bugtraq,4476
1804 || EXPERIMENTAL WEB-IIS Buffer Overrun in HTTP header handling || bugtraq,4476
1805 || WEB-CGI Oracle reports CGI access || bugtraq,4848

Revision 1.9 / (view) - annotate - [select for diffs] , Wed Jun 5 14:47:55 2002 UTC (7 years, 9 months ago) by cazz
Branch: MAIN
Changes since 1.8: +11 -3 lines
Diff to previous 1.8

* This is a massive change.  Since I'm really busy ATM, this is what changed.

* created imap.rules, nntp.rules, pop3.rules, other-ids.rules, web-client.rules,
   web-php.rules and moved signatures into those.

* added the following signatures:
1793 || PORN fetish
1794 || PORN masturbation
1795 || PORN ejaculation
1796 || PORN virgin
1797 || PORN BDSM
1798 || PORN erotica
1799 || PORN fisting
1800 || VIRUS Klez Incoming

Revision 1.8 / (view) - annotate - [select for diffs] , Wed May 15 12:45:32 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.7: +8 -8 lines
Diff to previous 1.7

woohoo.  Biggest change we've made in a while.  We've removed "flags:A+"
in favor of "flow:established".  Initial testing shows that this change
is about a 200% speed increase.

NOTE: I know that not all of the signatures have been converted.  There are
144 signatures with flags left to be looked at.  I'll commit them later today,
but this the majority of them.

Revision 1.7 / (view) - annotate - [select for diffs] , Sun May 12 23:14:00 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.6: +4 -1 lines
Diff to previous 1.6

* removed sid:1749 - duplicate of sid:1660
* updated sid:1426,1427 - added URL ref
* updated sid:1668 - corrected spelling mistake

Added signatures:
* 1752 || MISC AIM AddExternalApp attempt || url,www.w00w00.org/files/w00aimexp/

Revision 1.6 / (view) - annotate - [select for diffs] , Sat May 4 00:53:25 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.5: +5 -5 lines
Diff to previous 1.5

* removed spaces at the end of a ton of signatures.  Since this isn't technically modifying the sig, I didn't bump the rev.  Any decent parsing program shouldn't bitch at this.
* corrected sid:1747 - corrected msg (said UDP in TCP sig)
* corrected sid:1746 - corrected msg (said TCP in UDP sig)
* corrected sid:1562 - SITE CHOWN sig should look for SITE CHOWN, not USER
* added the following sigs:
1734 || EXPERIMENTAL FTP USER overflow attempt || bugtraq,4638
1735 || EXPERIMENTAL WEB-CLIENT XMLHttpRequest attempt
1736 || EXPERIMENTAL WEB-MISC squirrelmail spellcheck arbitrary command attemp || bugtraq,3952
1737 || EXPERIMENTAL WEB-MISC squirrelmail theme arbitrary command attempt || bugtraq,4385
1738 || EXPERIMENTAL WEB-MISC global.inc access || bugtraq,4612
1739 || EXPERIMENTAL WEB-PHP DNSTools administror authentication bypass attempt || bugtraq,4617
1740 || EXPERIMENTAL WEB-PHP DNSTools authentication bypass attempt || bugtraq,4617
1741 || EXPERIMENTAL WEB-PHP DNSTools access || bugtraq,4617
1742 || EXPERIMENTAL WEB-PHP Blahz-DNS dostuff.php modify user attempt || bugtraq,4618
1743 || EXPERIMENTAL WEB-PHP Blahz-DNS dostuff.php access || bugtraq,4618
1744 || EXPERIMENTAL WEB-MISC SecureSite authentication bypass attempt || bugtraq,4621
1745 || EXPERIMENTAL WEB-PHP Messagerie supp_membre.php access || bugtraq,4635
1746 || RPC UDP cachefsd request
1747 || RPC TCP cachefsd request
1748 || EXPERIMENTAL FTP command overflow attempt
1749 || EXPERIMENTAL WEB-IIS .NET trace.axd access
1750 || EXPERIMENTAL WEB-IIS users.xml access

Revision 1.5 / (view) - annotate - [select for diffs] , Thu May 2 17:31:41 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.4: +5 -1 lines
Diff to previous 1.4

* disable sid:1114 - webmasters suck, so this happens ever so often.  it is not really that bad, so disable it.

Revision 1.4 / (view) - annotate - [select for diffs] , Wed May 1 21:52:14 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.3: +2 -2 lines
Diff to previous 1.3

* cleaned up chat.rules info
* moved all .cgi rules from  web-misc to web-cgi
* moved sid:609 - moved to web-misc
* updated sid:1464 - no, oracle isn't usually thought of as a web server
* updated sid:1423,1425,1497,1667,1500,1619,1519,1520,1521,1522,1523,1524,1525,1526,1527,1540,1554,1545,1546,1551,1552,1559,1560,1561,1563,1564,1567,1568,1603,1618,1626,1642,1643,1668,1669,1670,1671 - s/HOME_NET/HTTP_SERVERS

Revision 1.3 / (view) - annotate - [select for diffs] , Sun Apr 14 15:35:16 2002 UTC (7 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.2: +2 -5 lines
Diff to previous 1.2

* updated sid:559 - removed newlines
* moved following sigs to their final resting place:
sid:1447 sid:1501 sid:1502 sid:1503 sid:1505 sid:1506 sid:1507 sid:1508
sid:1509 sid:1510 sid:1511 sid:1512 sid:1513 sid:1514 sid:1515 sid:1516
sid:1517 sid:1536 sid:1537 sid:1538 sid:1539 sid:1542 sid:1543 sid:1547
sid:1548 sid:1553 sid:1554 sid:1555 sid:1556 sid:1557 sid:1565 sid:1566
sid:1569 sid:1570 sid:1590 sid:1591 sid:1592 sid:1593 sid:1594 sid:1595
sid:1597 sid:1598 sid:1599 sid:1600 sid:1601 sid:1602 sid:1606 sid:1617

* updated sid:1243 - added bugtraq ref
* updated sid:1079 - added bugtraq ref
* updated sid:1225 - updated MSG
* updated sid:1227 - updated MSG

* added the following sigs:
1627 || BAD TRAFFIC Unassigned/Reserved IP protocol
1628 || WEB-CGI FormHandler.cgi directory traversal attempt attempt || cve,CAN-1999-1050
1629 || EXPERIMENTAL MISC SecureNetPro traffic

Revision 1.2 / (view) - annotate - [select for diffs] , Fri Apr 12 01:49:27 2002 UTC (7 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.1: +13 -1 lines
Diff to previous 1.1

* disabled sid:1121 - duplicate of 844
* disabled sid:1619 - duplicate of 987
* disabled sid:855  - sig looking for a site specific vulnerability on a site
                      that isn't vulnerable anymore
* updated sid:834 - added URL ref
* updated sid:836 - added CVE ref
* updated sid:832 - added CVE ref
* added the following signatures:
1620 || BAD TRAFFIC Non-Standard IP protocol
1621 || EXPERIMENTAL FTP EXPLOIT CMD overflow
1622 || EXPERIMENTAL FTP RNFR ././ attempt
1623 || EXPERIMENTAL FTP invalid MODE
1624 || EXPERIMENTAL FTP large PWD command
1625 || EXPERIMENTAL FTP large SYST command
1626 || EXPERIMENTAL WEB-IIS /StoreCSVS/InstantOrder.asmx request

Revision 1.1 / (view) - annotate - [select for diffs] , Sat Mar 23 14:40:20 2002 UTC (7 years, 11 months ago) by cazz
Branch: MAIN

* Added the following signatures:
1428 || EXPERIMENTAL audio galaxy keepalive
1429 || EXPERIMENTAL poll.gotomypc.com access || url,www.gotomypc.com/help2.tmpl
1430 || EXPERIMENTAL TELNET solaris memory mismanagement exploit attempt
1431 || EXPERIMENTAL BAD TRAFFIC syn to multicast address
1432 || INFO GNUTella GET
1433 || WEB-MISC .history access
1434 || WEB-MISC .bash_history access
1435 || DNS named authors attempt || arachnids,480
1436 || MULTIMEDIA Quicktime User Agent access
1437 || MULTIMEDIA Windows Media audio download
1438 || MULTIMEDIA Windows Media Video download
1439 || MULTIMEDIA Shoutcast playlist redirection
1440 || MULTIMEDIA Icecast playlist redirection
1441 || TFTP GET nc.exe
1442 || TFTP GET shadow
1443 || TFTP GET passwd
1444 || TFTP Get
1445 || FTP file_id.diz access
1446 || SMTP vrfy root

* Massive flow updates.  I hope nobody is using these signatures with 1.8.*

This form allows you to request diffs between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.

Diffs between and
Type of Diff should be a

snort-team@sourcefire.com

CVS log for snort/rules/deleted.rules

Help