CVS log for snort/rules/misc.rules

 (logo)

Help
(back) Up to [cvs] / snort / rules

Request diff between arbitrary revisions

Default branch: MAIN
Bookmark a link to: HEAD / (download)
Revision 1.59 / (view) - annotate - [select for diffs] , Tue Mar 1 18:57:10 2005 UTC (5 years ago) by bmc
Branch: MAIN
CVS Tags: HEAD
Changes since 1.58: +4 -2 lines
Diff to previous 1.58 
a ton of new rules
Revision 1.53.2.5 / (view) - annotate - [select for diffs] , Tue Mar 1 18:57:08 2005 UTC (5 years ago) by bmc
Branch: SNORT_2_3
Changes since 1.53.2.4: +4 -2 lines
Diff to previous 1.53.2.4 to branch point 1.53 to next main 1.54 
a ton of new rules
Revision 1.48.2.8 / (view) - annotate - [select for diffs] , Tue Mar 1 18:57:06 2005 UTC (5 years ago) by bmc
Branch: SNORT_2_2
Changes since 1.48.2.7: +4 -2 lines
Diff to previous 1.48.2.7 to branch point 1.48 to next main 1.49 
a ton of new rules
Revision 1.42.2.14 / (view) - annotate - [select for diffs] , Tue Mar 1 18:57:04 2005 UTC (5 years ago) by bmc
Branch: SNORT_2_1
Changes since 1.42.2.13: +4 -2 lines
Diff to previous 1.42.2.13 to branch point 1.42 to next main 1.43 
a ton of new rules
Revision 1.41.2.12 / (view) - annotate - [select for diffs] , Tue Mar 1 18:57:02 2005 UTC (5 years ago) by bmc
Branch: SNORT_2_0
Changes since 1.41.2.11: +3 -2 lines
Diff to previous 1.41.2.11 to branch point 1.41 to next main 1.42 
a ton of new rules
Revision 1.58 / (view) - annotate - [select for diffs] , Thu Feb 10 01:11:04 2005 UTC (5 years, 1 month ago) by bmc
Branch: MAIN
Changes since 1.57: +2 -1 lines
Diff to previous 1.57 
a bunch of new rules.  thanks microsoft, I didn't want to sleep on my birthday.  Really.
Revision 1.57 / (view) - annotate - [select for diffs] , Mon Jan 17 23:52:57 2005 UTC (5 years, 2 months ago) by bmc
Branch: MAIN
Changes since 1.56: +2 -1 lines
Diff to previous 1.56 
* more rules.  go sourcefire.  weee.
Revision 1.53.2.4 / (view) - annotate - [select for diffs] , Mon Jan 17 23:52:48 2005 UTC (5 years, 2 months ago) by bmc
Branch: SNORT_2_3
CVS Tags: STABLE, SNORT_v2_3_0
Changes since 1.53.2.3: +2 -1 lines
Diff to previous 1.53.2.3 to branch point 1.53 
* more rules.  go sourcefire.  weee.
Revision 1.48.2.7 / (view) - annotate - [select for diffs] , Mon Jan 17 23:52:28 2005 UTC (5 years, 2 months ago) by bmc
Branch: SNORT_2_2
Changes since 1.48.2.6: +2 -1 lines
Diff to previous 1.48.2.6 to branch point 1.48 
* more rules.  go sourcefire.  weee.
Revision 1.42.2.13 / (view) - annotate - [select for diffs] , Mon Jan 17 23:52:20 2005 UTC (5 years, 2 months ago) by bmc
Branch: SNORT_2_1
Changes since 1.42.2.12: +2 -1 lines
Diff to previous 1.42.2.12 to branch point 1.42 
* more rules.  go sourcefire.  weee.
Revision 1.56 / (view) - annotate - [select for diffs] , Wed Jan 12 15:46:11 2005 UTC (5 years, 2 months ago) by bmc
Branch: MAIN
Changes since 1.55: +3 -1 lines
Diff to previous 1.55 
a bunch of new rules.  go sourcefire.
Revision 1.53.2.3 / (view) - annotate - [select for diffs] , Wed Jan 12 15:46:05 2005 UTC (5 years, 2 months ago) by bmc
Branch: SNORT_2_3
Changes since 1.53.2.2: +2 -1 lines
Diff to previous 1.53.2.2 to branch point 1.53 
a bunch of new rules.  go sourcefire.
Revision 1.48.2.6 / (view) - annotate - [select for diffs] , Wed Jan 12 15:46:01 2005 UTC (5 years, 2 months ago) by bmc
Branch: SNORT_2_2
Changes since 1.48.2.5: +2 -1 lines
Diff to previous 1.48.2.5 to branch point 1.48 
a bunch of new rules.  go sourcefire.
Revision 1.42.2.12 / (view) - annotate - [select for diffs] , Wed Jan 12 15:45:56 2005 UTC (5 years, 2 months ago) by bmc
Branch: SNORT_2_1
Changes since 1.42.2.11: +2 -1 lines
Diff to previous 1.42.2.11 to branch point 1.42 
a bunch of new rules.  go sourcefire.
Revision 1.41.2.11 / (view) - annotate - [select for diffs] , Wed Jan 12 15:45:48 2005 UTC (5 years, 2 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.41.2.10: +2 -1 lines
Diff to previous 1.41.2.10 to branch point 1.41 
a bunch of new rules.  go sourcefire.
Revision 1.55 / (view) - annotate - [select for diffs] , Wed Oct 13 20:26:07 2004 UTC (5 years, 5 months ago) by bmc
Branch: MAIN
Changes since 1.54: +17 -17 lines
Diff to previous 1.54 
tons of new rules, tons of rule updates.  oracle & nntp xpat rules are the important ones
Revision 1.53.2.2 / (view) - annotate - [select for diffs] , Wed Oct 13 20:25:57 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_3
CVS Tags: SNORT_v2_3_0-RC2, SNORT_v2_3_0-RC1
Changes since 1.53.2.1: +17 -17 lines
Diff to previous 1.53.2.1 to branch point 1.53 
tons of new rules, tons of rule updates.  oracle & nntp xpat rules are the important ones
Revision 1.48.2.5 / (view) - annotate - [select for diffs] , Wed Oct 13 20:25:46 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_2
Changes since 1.48.2.4: +17 -17 lines
Diff to previous 1.48.2.4 to branch point 1.48 
tons of new rules, tons of rule updates.  oracle & nntp xpat rules are the important ones
Revision 1.42.2.11 / (view) - annotate - [select for diffs] , Wed Oct 13 20:25:35 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_1
Changes since 1.42.2.10: +14 -14 lines
Diff to previous 1.42.2.10 to branch point 1.42 
tons of new rules, tons of rule updates.  oracle & nntp xpat rules are the important ones
Revision 1.41.2.10 / (view) - annotate - [select for diffs] , Wed Oct 13 20:25:25 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.41.2.9: +11 -11 lines
Diff to previous 1.41.2.9 to branch point 1.41 
tons of new rules, tons of rule updates.  oracle & nntp xpat rules are the important ones
Revision 1.54 / (view) - annotate - [select for diffs] , Wed Sep 22 14:10:15 2004 UTC (5 years, 5 months ago) by bmc
Branch: MAIN
Changes since 1.53: +2 -2 lines
Diff to previous 1.53 
more rules.  huge amount of effort from the sourcefire rules team.  go, team, go.
Revision 1.53.2.1 / (view) - annotate - [select for diffs] , Wed Sep 22 14:10:11 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_3
Changes since 1.53: +2 -2 lines
Diff to previous 1.53 
more rules.  huge amount of effort from the sourcefire rules team.  go, team, go.
Revision 1.48.2.4 / (view) - annotate - [select for diffs] , Wed Sep 22 14:10:05 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_2
Changes since 1.48.2.3: +2 -2 lines
Diff to previous 1.48.2.3 to branch point 1.48 
more rules.  huge amount of effort from the sourcefire rules team.  go, team, go.
Revision 1.42.2.10 / (view) - annotate - [select for diffs] , Wed Sep 22 14:09:59 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_1
Changes since 1.42.2.9: +2 -2 lines
Diff to previous 1.42.2.9 to branch point 1.42 
more rules.  huge amount of effort from the sourcefire rules team.  go, team, go.
Revision 1.41.2.9 / (view) - annotate - [select for diffs] , Wed Sep 22 14:09:54 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.41.2.8: +2 -2 lines
Diff to previous 1.41.2.8 to branch point 1.41 
more rules.  huge amount of effort from the sourcefire rules team.  go, team, go.
Revision 1.41.2.8 / (view) - annotate - [select for diffs] , Fri Sep 10 18:32:47 2004 UTC (5 years, 6 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.41.2.7: +1 -3 lines
Diff to previous 1.41.2.7 to branch point 1.41 
* dedup
Revision 1.48.2.3 / (view) - annotate - [select for diffs] , Thu Aug 26 15:19:51 2004 UTC (5 years, 6 months ago) by bmc
Branch: SNORT_2_2
Changes since 1.48.2.2: +2 -2 lines
Diff to previous 1.48.2.2 to branch point 1.48 
* sync sync sync
Revision 1.42.2.9 / (view) - annotate - [select for diffs] , Thu Aug 26 15:18:57 2004 UTC (5 years, 6 months ago) by bmc
Branch: SNORT_2_1
Changes since 1.42.2.8: +2 -2 lines
Diff to previous 1.42.2.8 to branch point 1.42 
* sync sync sync
Revision 1.41.2.7 / (view) - annotate - [select for diffs] , Thu Aug 26 15:18:13 2004 UTC (5 years, 6 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.41.2.6: +2 -2 lines
Diff to previous 1.41.2.6 to branch point 1.41 
* sync sync sync
Revision 1.53 / (view) - annotate - [select for diffs] , Thu Aug 26 15:01:28 2004 UTC (5 years, 6 months ago) by bmc
Branch: MAIN
Branch point for: SNORT_2_3
Changes since 1.52: +2 -2 lines
Diff to previous 1.52 
* wee, more updates.  new rules for NSS SSL foo (judy & me ++)
Revision 1.41.2.6 / (view) - annotate - [select for diffs] , Tue Aug 10 14:01:51 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.41.2.5: +4 -4 lines
Diff to previous 1.41.2.5 to branch point 1.41 
* massive sync
Revision 1.42.2.8 / (view) - annotate - [select for diffs] , Tue Aug 10 13:59:23 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_1
Changes since 1.42.2.7: +6 -6 lines
Diff to previous 1.42.2.7 to branch point 1.42 
* massive sync
Revision 1.48.2.2 / (view) - annotate - [select for diffs] , Tue Aug 10 13:52:06 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_2
CVS Tags: SNORT_v2_2_0
Changes since 1.48.2.1: +11 -8 lines
Diff to previous 1.48.2.1 to branch point 1.48 
* sync sync sync
Revision 1.52 / (view) - annotate - [select for diffs] , Tue Aug 10 13:44:40 2004 UTC (5 years, 7 months ago) by bmc
Branch: MAIN
Changes since 1.51: +11 -8 lines
Diff to previous 1.51 
* tons of new rules
* tons of new rule references
* tons of new rule docs
* initial documentation on preprocessor alerts (gen-sid.txt in doc/signatures)
* new build of the manual
Revision 1.41.2.5 / (view) - annotate - [select for diffs] , Fri Jul 23 20:32:40 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.41.2.4: +4 -4 lines
Diff to previous 1.41.2.4 to branch point 1.41 
* sync ysnc ysnc sync ysnc ysnc sync ysnc ysnc sync ysnc ysnc
Revision 1.42.2.7 / (view) - annotate - [select for diffs] , Fri Jul 23 20:26:27 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_1
Changes since 1.42.2.6: +5 -4 lines
Diff to previous 1.42.2.6 to branch point 1.42 
* new rules
Revision 1.48.2.1 / (view) - annotate - [select for diffs] , Fri Jul 23 20:19:25 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_2
Changes since 1.48: +8 -5 lines
Diff to previous 1.48 
* massive sync here too
Revision 1.51 / (view) - annotate - [select for diffs] , Fri Jul 23 20:15:44 2004 UTC (5 years, 7 months ago) by bmc
Branch: MAIN
Changes since 1.50: +8 -5 lines
Diff to previous 1.50 
* sync sync sync
* go ruleteam go
Revision 1.41.2.4 / (view) - annotate - [select for diffs] , Thu Jul 15 19:14:33 2004 UTC (5 years, 8 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.41.2.3: +48 -41 lines
Diff to previous 1.41.2.3 to branch point 1.41 
* massive sync from head
Revision 1.50 / (view) - annotate - [select for diffs] , Thu Jul 15 16:21:28 2004 UTC (5 years, 8 months ago) by bmc
Branch: MAIN
Changes since 1.49: +22 -22 lines
Diff to previous 1.49 
* yet another sync, lets go forward in time, not backwards...
Revision 1.49 / (view) - annotate - [select for diffs] , Wed Jul 14 21:16:09 2004 UTC (5 years, 8 months ago) by bmc
Branch: MAIN
Changes since 1.48: +22 -22 lines
Diff to previous 1.48 
* massive rule updates (go ruleteam, go)
Revision 1.42.2.6 / (view) - annotate - [select for diffs] , Wed Jun 16 15:11:07 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: SNORT_2_1
Changes since 1.42.2.5: +21 -21 lines
Diff to previous 1.42.2.5 to branch point 1.42 
* Syncing changes for rules team
Revision 1.48 / (view) - annotate - [select for diffs] , Tue Jun 15 13:47:07 2004 UTC (5 years, 9 months ago) by bmc
Branch: MAIN
CVS Tags: SNORT_v2_2_0-RC1
Branch point for: SNORT_2_2
Changes since 1.47: +22 -22 lines
Diff to previous 1.47 
* lets try this *again*
Revision 1.47 / (view) - annotate - [select for diffs] , Thu Jun 3 20:11:05 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: MAIN
Changes since 1.46: +63 -49 lines
Diff to previous 1.46 
* sync with sforge current
Revision 1.42.2.5 / (view) - annotate - [select for diffs] , Thu Jun 3 18:13:37 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: SNORT_2_1
CVS Tags: SNORT_v2_1_3
Changes since 1.42.2.4: +51 -47 lines
Diff to previous 1.42.2.4 to branch point 1.42 
* updating 2.1.3 from sforge
Revision 1.42.2.4 / (view) - annotate - [select for diffs] , Fri May 28 19:21:40 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: SNORT_2_1
Changes since 1.42.2.3: +6 -4 lines
Diff to previous 1.42.2.3 to branch point 1.42 
* syncing up sfire with sforge 2.1 branch
Revision 1.46 / (view) - annotate - [select for diffs] , Sun Apr 18 20:32:59 2004 UTC (5 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.45: +7 -4 lines
Diff to previous 1.45 
* a ton of new rules, a bunch of updates too.

2447 || WEB-MISC ServletManager access || cve,CAN-2001-1195 || nessus,12122
2448 || WEB-MISC setinfo.hts access || bugtraq,9973 || nessus,12120
2449 || FTP ALLO overflow attempt || bugtraq,9953
2450 || CHAT Yahoo IM successful logon
2451 || CHAT Yahoo IM voicechat
2452 || CHAT Yahoo IM ping
2453 || CHAT Yahoo IM conference invitation
2454 || CHAT Yahoo IM conference logon success
2455 || CHAT Yahoo IM conference message
2456 || CHAT Yahoo IM file transfer request
2457 || CHAT Yahoo IM message
2458 || CHAT Yahoo IM successful chat join
2459 || CHAT Yahoo IM webcam offer invitation
2460 || CHAT Yahoo IM webcam request
2461 || CHAT Yahoo IM webcam watch
2462 || EXPLOIT IGMP IGAP account overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2463 || EXPLOIT IGMP IGAP message overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2464 || EXPLOIT EIGRP prefix length overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2465 || NETBIOS SMB-DS IPC$ share access
2466 || NETBIOS SMB-DS IPC$ share unicode access
2467 || NETBIOS SMB D$ share unicode access
2468 || NETBIOS SMB-DS D$ share access
2469 || NETBIOS SMB-DS D$ share unicode access
2470 || NETBIOS SMB C$ share unicode access
2471 || NETBIOS SMB-DS C$ share access
2472 || NETBIOS SMB-DS C$ share unicode access
2473 || NETBIOS SMB ADMIN$ share unicode access
2474 || NETBIOS SMB-DS ADMIN$ share access
2475 || NETBIOS SMB-DS ADMIN$ share unicode access
2476 || NETBIOS SMB-DS Create AndX Request winreg attempt
2477 || NETBIOS SMB-DS Create AndX Request winreg unicode attempt
2478 || NETBIOS SMB-DS DCERPC bind winreg attempt
2479 || NETBIOS SMB-DS DCERPC bind winreg unicode attempt
2480 || NETBIOS SMB-DS DCERPC shutdown unicode attempt
2481 || NETBIOS SMB-DS DCERPC shutdown unicode little endian attempt
2482 || NETBIOS SMB-DS DCERPC shutdown attempt
2483 || NETBIOS SMB-DS DCERPC shutdown little endian attempt
2484 || WEB-MISC source.jsp access || nessus,12119
2485 || WEB-CLIENT Nortan antivirus sysmspam.dll load attempt || bugtraq,9916
2486 || DOS ISAKMP invalid identification payload attempt || bugtraq,10004
2487 || SMTP WinZip MIME content-type buffer overflow || bugtraq,9758
2488 || SMTP WinZip MIME content-disposition buffer overflow || bugtraq,9758
2489 || EXPLOIT esignal STREAMQUOTE buffer overflow attempt || bugtraq,9978
2490 || EXPLOIT esignal SNAPQUOTE buffer overflow attempt || bugtraq,9978
2491 || NETBIOS SMB-DS DCERPC ISystemActivator unicode bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2492 || NETBIOS SMB DCERPC ISystemActivator bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2493 || NETBIOS SMB DCERPC ISystemActivator unicode bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2494 || NETBIOS DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2495 || NETBIOS SMB DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2496 || NETBIOS SMB-DS DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2497 || IMAP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2498 || IMAP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2499 || MISC LDAP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2500 || MISC LDAP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2501 || POP3 invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2502 || POP3 invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2503 || SMTP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2504 || SMTP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2505 || WEB-MISC invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2506 || WEB-MISC invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
Revision 1.41.2.3 / (view) - annotate - [select for diffs] , Mon Mar 22 16:26:30 2004 UTC (5 years, 11 months ago) by cazz
Branch: SNORT_2_0
Changes since 1.41.2.2: +2 -1 lines
Diff to previous 1.41.2.2 to branch point 1.41 
* sync sync sync
Revision 1.42.2.3 / (view) - annotate - [select for diffs] , Mon Mar 22 16:18:34 2004 UTC (5 years, 11 months ago) by cazz
Branch: SNORT_2_1
CVS Tags: SNORT_v2_1_3-RC1, SNORT_v2_1_2
Changes since 1.42.2.2: +2 -1 lines
Diff to previous 1.42.2.2 to branch point 1.42 
* sync sync sync
Revision 1.45 / (view) - annotate - [select for diffs] , Sat Mar 20 21:58:43 2004 UTC (6 years ago) by cazz
Branch: MAIN
Changes since 1.44: +3 -2 lines
Diff to previous 1.44 
* Added a ton of rules that include vulnerabilities in many high-profile
  security products, including Checkpoint & ISS gear (see below)
* provided a single high-powered rule for detecting all of the evil virus emails
* added even more docs.  (Go Nigel)

2405 || WEB-PHP phptest.php access || bugtraq,9737
2406 || TELNET APC SmartSlot default admin account attempt || bugtraq,9681
2407 || WEB-MISC util.pl access || bugtraq,9748
2408 || WEB-MISC Invision Power Board search.pl access || bugtraq,9766
2409 || POP3 APOP USER overflow attempt || bugtraq,9794
2410 || WEB-PHP IGeneric Free Shopping Cart page.php access || bugtraq,9773
2411 || WEB-MISC Real Server DESCRIBE buffer overflow attempt || url,www.service.real.com/help/faq/security/rootexploit091103.html || bugtraq,8476
2412 || ATTACK-RESPONSES successful cross site scripting forced download attempt
2413 || EXPLOIT ISAKMP delete hash with empty hash attempt || bugtraq,9416 || bugtraq,CAN-2004-0164
2414 || EXPLOIT ISAKMP initial contact notification without SPI attempt || bugtraq,9416 || bugtraq,CAN-2004-0164
2415 || EXPLOIT ISAKMP second payload initial contact notification without SPI attempt || bugtraq,9416 || bugtraq,CAN-2004-0164
2416 || FTP invalid MDTM command attempt
2417 || FTP format string attempt
2418 || MISC MS Terminal Server no encryption session initiation attmept || url,www.microsoft.com/technet/security/bulletin/MS01-052.asp
2419 || MULTIMEDIA realplayer .ram playlist download attempt
2420 || MULTIMEDIA realplayer .rmp playlist download attempt
2421 || MULTIMEDIA realplayer .smi playlist download attempt
2422 || MULTIMEDIA realplayer .rt playlist download attempt
2423 || MULTIMEDIA realplayer .rp playlist download attempt
2424 || NNTP sendsys overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2425 || NNTP senduuname overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2426 || NNTP version overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2427 || NNTP checkgroups overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2428 || NNTP ihave overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2429 || NNTP sendme overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2430 || NNTP newgroup overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2431 || NNTP rmgroup overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2432 || NNTP article post without path attempt
2433 || WEB-CGI MDaemon form2raw.cgi overflow attempt || bugtraq,9317
2434 || WEB-CGI MDaemon form2raw.cgi access || bugtraq,9317
2435 || WEB-CLIENT Microsoft emf metafile access || bugtraq,9707
2436 || WEB-CLIENT Microsoft wmf metafile access || bugtraq,9707
2437 || WEB-CLIENT RealPlayer arbitrary javascript command attempt || bugtraq,8453 || bugtraq,9738 || cve,CAN-2003-0726
2438 || WEB-CLIENT RealPlayer playlist file URL overflow attempt || bugtraq,9579
2439 || WEB-CLIENT RealPlayer playlist http URL overflow attempt || bugtraq,9579
2440 || WEB-CLIENT RealPlayer playlist rtsp URL overflow attempt || bugtraq,9579
2441 || WEB-MISC NetObserve authentication bypass attempt || bugtraq,9319
2442 || WEB-MISC Quicktime User-Agent buffer overflow attempt || cve,CAN-2004-0169
2443 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
2444 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
2445 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER last name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
2446 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER email overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
Revision 1.42.2.2 / (view) - annotate - [select for diffs] , Wed Feb 25 16:52:51 2004 UTC (6 years ago) by jh8
Branch: SNORT_2_1
CVS Tags: SNORT_v2_1_1
Changes since 1.42.2.1: +2 -2 lines
Diff to previous 1.42.2.1 to branch point 1.42 
* Bringing RC1 up to 2.1.1
Revision 1.41.2.2 / (view) - annotate - [select for diffs] , Sat Feb 21 16:56:29 2004 UTC (6 years ago) by cazz
Branch: SNORT_2_0
Changes since 1.41.2.1: +1 -5 lines
Diff to previous 1.41.2.1 to branch point 1.41 
* oops, a few dups (Thanks to Andreas for pointing them out)
Revision 1.41.2.1 / (view) - annotate - [select for diffs] , Fri Feb 20 20:39:31 2004 UTC (6 years ago) by cazz
Branch: SNORT_2_0
Changes since 1.41: +7 -2 lines
Diff to previous 1.41 
* sync sync sync, sync sync sync, sync your rules
Revision 1.44 / (view) - annotate - [select for diffs] , Fri Feb 20 17:16:36 2004 UTC (6 years ago) by cazz
Branch: MAIN
Changes since 1.43: +2 -2 lines
Diff to previous 1.43 
* bunch o bunch o updates
Revision 1.42.2.1 / (view) - annotate - [select for diffs] , Tue Jan 20 21:31:38 2004 UTC (6 years, 2 months ago) by jh8
Branch: SNORT_2_1
CVS Tags: SNORT_v2_1_1-RC1
Changes since 1.42: +8 -6 lines
Diff to previous 1.42 
* 2.1.1-RC1
Revision 1.43 / (view) - annotate - [select for diffs] , Fri Jan 9 22:14:22 2004 UTC (6 years, 2 months ago) by cazz
Branch: MAIN
Changes since 1.42: +8 -6 lines
Diff to previous 1.42 
* add stateless to a few more rules that I missed.
* Add the following rules:
sid:2317 - MISC CVS non-relative path error response || bugtraq,9178 || cve,CAN-2003-0977
sid:2318 - MISC CVS non-relative path access attempt || bugtraq,9178 || cve,CAN-2003-0977
sid:2319 - EXPLOIT ebola PASS overflow attempt || bugtraq,9156
sid:2320 - EXPLOIT ebola USER overflow attempt || bugtraq,9156
Revision 1.42 / (view) - annotate - [select for diffs] , Mon Oct 20 15:03:10 2003 UTC (6 years, 5 months ago) by chrisgreen
Branch: MAIN
CVS Tags: version-2-1-0, cmg, SNORT_v2_1_0
Branch point for: SNORT_2_1
Changes since 1.41: +3 -3 lines
Diff to previous 1.41 
* Major add/commit of 2.1 feature set...

  Will do a tag and then remove the "moved" files
Revision 1.41 / (view) - annotate - [select for diffs] , Fri Jun 13 18:24:59 2003 UTC (6 years, 9 months ago) by cazz
Branch: MAIN
CVS Tags: version-2-0-6, version-2-0-5, version-2-0-2, version-2-0-1
Branch point for: SNORT_2_0
Changes since 1.40: +6 -1 lines
Diff to previous 1.40 
* added sid:2123 - ATTACK-RESPONSES Microsoft cmd.exe banner
* added sid:2124 - BACKDOOR Remote PC Access connection attempt
* added sid:2125 - FTP CWD C:\\
* added sid:2126 - MISC Microsoft PPTP Start Control Request buffer overflow attempt
* added sid:2127 - WEB-CGI ikonboard.cgi access
* added sid:2128 - WEB-CGI swsrv.cgi access
* added sid:2129 - WEB-IIS nsiislog.dll access
* added sid:2130 - WEB-IIS IISProtect siteadmin.asp access
* added sid:2131 - WEB-IIS IISProtect access
* added sid:2132 - WEB-IIS Synchrologic Email Accelerator userid list access attempt
* added sid:2133 - WEB-IIS MS BizTalk server access
* added sid:2134 - WEB-IIS register.asp access
* added sid:2135 - WEB-MISC philboard.mdb access
* added sid:2136 - WEB-MISC philboard_admin.asp authentication bypass attempt
* added sid:2137 - WEB-MISC philboard_admin.asp access
* added sid:2138 - WEB-MISC logicworks.ini access
* added sid:2139 - WEB-MISC /*.shtml access
* added sid:2140 - WEB-PHP p-news.php access
* added sid:2141 - WEB-PHP shoutbox.php directory traversal attempt
* added sid:2142 - WEB-PHP shoutbox.php access
* added sid:2143 - WEB-PHP b2 cafelog gm-2-b2.php remote command execution attempt
* added sid:2144 - WEB-PHP b2 cafelog gm-2-b2.php access
* added sid:2145 - WEB-PHP TextPortal admin.php default password (admin) attempt
* added sid:2146 - WEB-PHP TextPortal admin.php default password (12345) attempt
* added sid:2147 - WEB-PHP BLNews objects.inc.php4 remote command execution attempt
* added sid:2148 - WEB-PHP BLNews objects.inc.php4 access
* added sid:2149 - WEB-PHP Turba status.php access
* added sid:2150 - WEB-PHP ttCMS header.php remote command execution attempt
* added sid:2151 - WEB-PHP ttCMS header.php access
* added sid:2152 - WEB-PHP test.php access
* added sid:2153 - WEB-PHP autohtml.php directory traversal attempt
* added sid:2154 - WEB-PHP autohtml.php access
* added sid:2155 - WEB-PHP ttforum remote command execution attempt
* added sid:2156 - WEB-MISC mod_gzip_status access
* added sid:2157 - WEB-IIS IISProtect GlobalAdmin.asp access
* added sid:2158 - MISC BGP invalid length
* added sid:2159 - MISC BGP invalid type (0)
* added sid:2160 - VIRUS OUTBOUND .exe file attachment
* added sid:2161 - VIRUS OUTBOUND .doc file attachment
* added sid:2162 - VIRUS OUTBOUND .hta file attachment
* added sid:2163 - VIRUS OUTBOUND .chm file attachment
* added sid:2164 - VIRUS OUTBOUND .reg file attachment
* added sid:2165 - VIRUS OUTBOUND .ini file attachment
* added sid:2166 - VIRUS OUTBOUND .bat file attachment
* added sid:2167 - VIRUS OUTBOUND .diz file attachment
* added sid:2168 - VIRUS OUTBOUND .cpp file attachment
* added sid:2169 - VIRUS OUTBOUND .dll file attachment
* added sid:2170 - VIRUS OUTBOUND .vxd file attachment
* added sid:2171 - VIRUS OUTBOUND .sys file attachment
* added sid:2172 - VIRUS OUTBOUND .com file attachment
* added sid:2173 - VIRUS OUTBOUND .hsq file attachment
* added sid:2174 - NETBIOS SMB winreg access
* added sid:2175 - NETBIOS SMB winreg access (unicode)
* added sid:2176 - NETBIOS SMB Startup Folder access attempt
* added sid:2177 - NETBIOS SMB Startup Folder access attempt (unicode)
Revision 1.40 / (view) - annotate - [select for diffs] , Thu Apr 17 00:35:47 2003 UTC (6 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.39: +28 -12 lines
Diff to previous 1.39 
* MASSIVE sync of rules

This is the first major sync of rules since I started working for Sourcefire.

Many of these updates are a direct result of my employment at Sourcefire.  We
have time and resources to test and document rules extensively.  Many people
have contributed to these updates.  Too many to mention here.

You should continue to see awesome updates, rewrites and new rules as
Sourcefire is dedicating serious resources to the Snort project.

Even if you don't buy an appliance from Sourcefire, you should send an
email to info@sourcefire.com to let them know how much you appreciate their
dedication to making snort awesome.
Revision 1.39 / (view) - annotate - [select for diffs] , Tue Mar 4 21:56:35 2003 UTC (7 years ago) by cazz
Branch: MAIN
CVS Tags: version-2-0-0, CMG
Changes since 1.38: +7 -1 lines
Diff to previous 1.38 
* merge more rules
2004 || MS-SQL Worm propagation attempt OUTBOUND
2005 || RPC UDP kcms_server request
2006 || RPC TCP kcms_server request
2007 || RPC kcms_server directory traversal attempt
2008 || MISC CVS invalid user authentication response
2009 || MISC CVS invalid repository response
2010 || MISC CVS double free exploit attempt response || bugtraq,6650 || cve,CAN-2003-0015
2011 || MISC CVS invalid directory response || bugtraq,6650 || cve,CAN-2003-0015
2012 || MISC CVS missing cvsroot response
2013 || MISC CVS invalid module response
Revision 1.33.2.3 / (view) - annotate - [select for diffs] , Tue Mar 4 21:47:52 2003 UTC (7 years ago) by cazz
Branch: SNORT_1_9
Changes since 1.33.2.2: +7 -1 lines
Diff to previous 1.33.2.2 to branch point 1.33 to next main 1.34 
* merge more rules
2004 || MS-SQL Worm propagation attempt OUTBOUND
2005 || RPC UDP kcms_server request
2006 || RPC TCP kcms_server request
2007 || RPC kcms_server directory traversal attempt
2008 || MISC CVS invalid user authentication response
2009 || MISC CVS invalid repository response
2010 || MISC CVS double free exploit attempt response || bugtraq,6650 || cve,CAN-2003-0015
2011 || MISC CVS invalid directory response || bugtraq,6650 || cve,CAN-2003-0015
2012 || MISC CVS missing cvsroot response
2013 || MISC CVS invalid module response
Revision 1.33.2.2 / (view) - annotate - [select for diffs] , Sun Feb 9 03:27:30 2003 UTC (7 years, 1 month ago) by cazz
Branch: SNORT_1_9
CVS Tags: version-1-9-1
Changes since 1.33.2.1: +4 -1 lines
Diff to previous 1.33.2.1 to branch point 1.33 
* merge the rest of the changes from current.

Most of this done thanks to the large efforts from Frank Knobbe and
Russell Fulton (at least, I think its Fulton :P)

Thanks guys.  (Oh, anyone reading these, send them an email thanking them
for their efforts.)
Revision 1.38 / (view) - annotate - [select for diffs] , Wed Jan 22 02:35:10 2003 UTC (7 years, 1 month ago) by cazz
Branch: MAIN
Changes since 1.37: +2 -1 lines
Diff to previous 1.37 
* wee.  new rules.  check snort-sigs in a bit for the changes
Revision 1.37 / (view) - annotate - [select for diffs] , Mon Nov 25 01:58:12 2002 UTC (7 years, 3 months ago) by cazz
Branch: MAIN
Changes since 1.36: +5 -2 lines
Diff to previous 1.36 
* updated sid:107 - corrected bad content checks
* updated sid:159 - corrected client/server pair
* updated sid:195 - corrected client/server pair
* updated sid:1929 - (trust me, it changed between 1,2 and 3)
* updated sid:524 - removed invalid references
* updated sid:238 - corrected client/server pair
* updated sid:1257 - added additional ports that can be targetted
* updated sid:306 - added reference
* updated sid:1919 - added references
* updated sid:1734 - added references
* updated sid:361 - added distance to limit false positives
* updated sid:362 - removed RETR content check (can be used with STOR as well)
* updated sid:1377 - added distance to limit false positives
* updated sid:1378 - added distance to limit false positives
* re-enabled sid:1748 - should be on by default
* updated sid:1844 - use byte_test instead of distance
* updated sid:1845 - use byte_test instead of distance
* updated sid:1903 - remove additional un-needed content
* updated sid:1755 - use within
* disabled sid:293 - replaced with other sids
* disabled sid:295 - replaced with other sids
* disabled sid:296 - replaced with other sids
* disabled sid:297 - replaced with other sids
* disabled sid:298 - replaced with other sids
* disabled sid:299 - replaced with other sids
* updated sid:489 - added within
* updated sid:1866 - added references
* disabled sid:570 - replaced with other sids
* disabled sid:571 - replaced with other sids
* updated sid:664 - updated MSG to be more clear
* updated sid:1289 - added offsets
* updated sid:1441 - added offsets
* updated sid:1442 - added offsets
* updated sid:1443 - added offsets
* updated sid:519 - added offsets
* updated sid:1149 - updated MSG to be more clear
* disabled sid:1287 - too false positive to be on by default
* updated sid:1069 - updated MSG to be more clear
* updated sid:1519 - updated MSG to be correct, update content to be correct
* updated sid:1809 - use HTTP_PORTS instead of 80
* updated sid:1826 - correct uricontent
* disabled sid:1171 - too false positive to be on by default

* deleted sid:874 - very bad rule
* deleted sid:318 - replaced by sid:1939 and sid:1940
* deleted sid:319 - replaced by sid:1939 and sid:1940

* reordered rpc.rules to be a bit more clear
* reordered dns.rules to be a bit more clear
* added pop2.rules
* disaabled asn1_decode, as it shouldn't be on by default
* added the following rules:
1929 || BACKDOOR TCPDUMP/PCAP trojan traffic || url,hlug.fscker.com
1930 || IMAP auth overflow attempt || cve,CVE-1999-0005
1931 || WEB-CGI rpc-nlog.pl access || cve,CAN-1999-1278
1932 || WEB-CGI rpc-smb.pl access || cve,CAN-1999-1278
1933 || WEB-CGI cart.cgi access
1934 || POP2 FOLD overflow attempt || cve,CVE-1999-0920 || bugtraq,283
1935 || POP2 FOLD arbitrary file attempt
1936 || POP3 AUTH overflow attempt
1937 || POP3 LIST overflow attempt || cve,CAN-2000-0096 || bugtraq,948
1938 || POP3 XTND overflow attempt
1939 || MISC bootp hardware address lenght overflow || cve,CAN-1999-0798
1940 || MISC bootp invalid hardware type || cve,CAN-1999-0798
1941 || TFTP filename overflow attempt || bugtraq,5328 || cve,CAN-2002-0813
1942 || FTP RMDIR overflow attempt
1943 || WEB-MISC /Carello/add.exe access || bugtraq,1245 || cve,CVE-2000-0396
1944 || WEB-MISC /ecscripts/ecware.exe access
1945 || WEB-IIS unicode directory traversal attempt || cve,CVE-2000-0884
1946 || WEB-MISC answerbook2 admin attempt
1947 || WEB-MISC answerbook2 arbitrary command execution attempt
1948 || DNS zone transfer UDP || arachnids,212 || cve,CAN-1999-0532
1949 || RPC portmap SET attempt TCP 111
1950 || RPC portmap SET attempt UDP 111
1951 || RPC mountd TCP mount request
1952 || RPC mountd UDP export request
1953 || RPC AMD TCP pid request
1954 || RPC AMD UDP pid request
1955 || RPC AMD TCP version request
1956 || RPC AMD UDP version request
1957 || RPC sadmind UDP PING || bugtraq,866
1958 || RPC sadmind TCP PING || bugtraq,866
1959 || RPC portmap request NFS UDP
1960 || RPC portmap request NFS TCP
1961 || RPC portmap request RQUOTA UDP
1962 || RPC portmap request RQUOTA TCP
1963 || RPC RQUOTA UDP getquota overflow attempt || bugtraq,864 || cve,CVE-1999-0974
1964 || RPC tooltalk UDP overflow attempt
1965 || RPC tooltalk TCP overflow attempt
1966 || MISC GlobalSunTech Access Point Information Discolsure attempt || bugtraq,6100
1967 || WEB-PHP phpbb quick-reply.php arbitrary command attempt || bugtraq,6173
1968 || WEB-PHP phpbb quick-reply.php access || bugtraq,6173
1969 || WEB-MISC ion-p access || bugtraq,6091
1970 || WEB-IIS MDAC Content-Type overflow attempt
1971 || FTP SITE EXEC format string attempt
1972 || FTP PASS overflow attempt || cve,CAN-2002-0126 || cve,CAN-2000-1035
1973 || FTP MKD overflow attempt || bugtraq,612 || cve,CAN-1999-0911
1974 || FTP REST overflow attempt || cve,CAN-2001-0826
1975 || FTP DELE overflow attempt || cve,CAN-2001-0826
1976 || FTP RMD overflow attempt || cve,CAN-2001-0826
1977 || WEB-MISC xp_regwrite attempt
1978 || WEB-MISC xp_regdeletekey attempt
1979 || WEB-MISC perl post attempt || nessus,11158 || bugtraq,5520
Revision 1.33.2.1 / (view) - annotate - [select for diffs] , Sun Nov 17 04:40:08 2002 UTC (7 years, 4 months ago) by cazz
Branch: SNORT_1_9
Changes since 1.33: +16 -2 lines
Diff to previous 1.33 
* major sync from current (look ma, no experimental.rules)
* added pop2.rules
* regen sid-msg.map
Revision 1.36 / (view) - annotate - [select for diffs] , Wed Nov 6 13:35:14 2002 UTC (7 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.35: +14 -1 lines
Diff to previous 1.35 
* add my notes to RULES.todo
* delete sid:1620 - spp_conversation takes care of this
* moved sid:1429,1447,1448,1545,1636,1641,1771,1791,1801,1802,1803,1804,1808,
  1810,1811,1812,1819,1821,1832,1838,1842,1843,1844,1845,1902,1903,1904,1846,
  1853,1854,1855,1856,1865,1888,1887,1889,1905,1906,1907,1908,1909,1910,1911,
  1912,1480,1913,1914,1915,1916,1917,1918 to their final resting place.

This marks the end of experimental.rules.  Please take a moment of silence.
Revision 1.35 / (view) - annotate - [select for diffs] , Tue Nov 5 21:02:00 2002 UTC (7 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.34: +2 -2 lines
Diff to previous 1.34 
* updated sid:1382 - removed dsize, added within
* deleted sid:329 - duplicate of 330
* deleted sid:1477 - duplicate of 1478
* deleted sid:1246 - duplicate of 1248
* deleted sid:1247 - duplicate of 1249
* deleted sid:1171 - broken because of stream reassembly, needs added to httpd decoder
* deleted sid:1104 - broken because of stream reassembly, needs added to httpd decoder
* deleted sid:1087 - broken because of stream reassembly, needs added to httpd decoder
* deleted sid:1780 - duplicate of 1755
* deleted sid:291 - duplicate of 1538
* updated sid:1842 - removed dsize, added within
* updated sid:337 - updated msg, removed dsize, added within
* updated sid:1377 - added CVE references
* updated sid:1378 - added CVE references
* updated sid:1379 - removed dsize, added within
* updated sid:1621 - removed dsize, added within
* updated sid:1529 - removed dsize, added within
* updated sid:1630 - removed dsize, added within
* updated sid:1562 - removed dsize, added within
* updated sid:1734 - removed dsize, added within
* updated sid:1755 - added CVE reference, added within
* updated sid:1388 - removed dsize, added within
* updated sid:1792 - added CVE reference, removed dsize, added within
* updated sid:1538 - added arachnids reference, removed dsize, added within
* updated sid:1866 - removed dsize, added within
* updated sid:1634 - removed dsize, added within
* updated sid:1635 - removed dsize, added within
* disabled sid:596 - soon to be replaced by other rules
* disabled sid:597 - soon to be replaced by other rules
* updated sid:1280 - added within to skip revisions (evasion protection)
* updated sid:598 - added within to skip revisions (evasion protection)
* updated sid:599 - added within to skip revisions (evasion protection)
* updated sid:1281 - added within to skip revisions (evasion protection)
* disabled sid:600 - soon to be replaced by other rules
* disabled sid:1282 - soon to be replaced by other rules
* updated sid:654 - removed dsize, added within
* updated sid:657 - removed dsize, added within
* updated sid:1549 - removed dsize, added within
* updated sid:1550 - removed dsize, added within
* updated sid:804 - removed dsize
* updated sid:821 - removed dsize
* updated sid:1242 - removed dsize
* updated sid:1244 - removed dsize
* updated sid:981:
  - removed "/scripts", attackers can use other directories
  - s/uricontent/content/ (http decoder decodes uricontent, we don't want to
    look at the decoded portion)
* updated sid:982:
  - removed "/scripts", attackers can use other directories
  - s/uricontent/content/ (http decoder decodes uricontent, we don't want to
    look at the decoded portion)
* updated sid:983:
  - removed "/scripts", attackers can use other directories
  - s/uricontent/content/ (http decoder decodes uricontent, we don't want to
    look at the decoded portion)
* updated sid:1044 - removed dsize
* updated sid:1181 - removed dsize
* updated sid:1258 - removed dsize
* updated sid:1260 - removed dsize, added within
* added the following rules:
1902 || EXPERIMENTAL IMAP lsub overflow attempt || cve,CAN-2000-0284 || nessus,10374
1903 || EXPERIMENTAL IMAP rename overflow attempt || cve,CAN-2000-0284 || nessus,10374
1904 || EXPERIMENTAL IMAP find overflow attempt || cve,CAN-2000-0284 || nessus,10374
1905 || RPC AMD UDP amqproc_mount plog overflow attempt || bugtraq,614 || cve,CVE-1999-0704
1906 || RPC AMD TCP amqproc_mount plog overflow attempt || bugtraq,614 || cve,CVE-1999-0704
1907 || RPC CMSD UDP CMSD_CREATE buffer overflow attempt || bugtraq,524 || cve,CVE-1999-0696
1908 || RPC CMSD TCP CMSD_CREATE buffer overflow attempt || bugtraq,524 || cve,CVE-1999-0696
1909 || RPC CMSD TCP CMSD_INSERT buffer overflow attempt || url,www.cert.org/advisories/CA-99-08-cmsd.html || cve,CVE-1999-0696
1910 || RPC CMSD udp CMSD_INSERT buffer overflow attempt || url,www.cert.org/advisories/CA-99-08-cmsd.html || cve,CVE-1999-0696
1911 || RPC sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt || bugtraq,866 || cve,CVE-1999-0977
1912 || RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt || bugtraq,866 || cve,CVE-1999-0977
1913 || RPC STATD UDP stat mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1914 || RPC STATD TCP stat mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1915 || RPC STATD UDP monitor mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1916 || RPC STATD TCP monitor mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1917 || SCAN UPNP service discover attempt
1918 || SCAN SolarWinds IP scan attempt
1919 || FTP CWD overflow attempt
1920 || FTP SITE NEWER overflow attempt || cve,CVE-1999-0800
1921 || FTP SITE ZIPCHK attempt || cve,CVE-2000-0040
1922 || RPC portmap TCP proxy attempt
1923 || RPC portmap UDP proxy attempt
Revision 1.34 / (view) - annotate - [select for diffs] , Mon Oct 28 22:08:07 2002 UTC (7 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.33: +2 -1 lines
Diff to previous 1.33 
* moved to proper .rules file from experimental.rules:
1605,1504,1890,1891,1638,1822,1823,1824,1825,1868,1869,1870,1875,1876,1877,
1878,1840,1841,1817,1818,1814,1826,1820,1827,1828,1829,1830,1831,1835,1839,
1847,1848,1849,1850,1851,1852,1857,1859,1860,1861,1862,1863,1871,1872,1873,
1874,1881,1815,1816,1834
* updated sid:1337,1338 - correced content, don't include the full path
Revision 1.33 / (view) - annotate - [select for diffs] , Sun Aug 18 20:28:43 2002 UTC (7 years, 7 months ago) by cazz
Branch: MAIN
CVS Tags: version-1-9-0
Branch point for: SNORT_1_9
Changes since 1.32: +3 -2 lines
Diff to previous 1.32 
* large update of signatures.  CVS disconnected during the last commit, so
  this is a recommit
Revision 1.32 / (view) - annotate - [select for diffs] , Sun Aug 11 23:37:18 2002 UTC (7 years, 7 months ago) by cazz
Branch: MAIN
CVS Tags: beta-1_9_0-beta5, beta-1_9_0-beta4
Changes since 1.31: +5 -2 lines
Diff to previous 1.31 
* added default-login-attempt classification
* added notes for sid:1447,1448 about signature responses
* updated sid:1847 - added references
* updated sid:345 - update to remove a potentual false negative
* updated sid:1622 - removed extra spaces
* updated sid:517 - removed extra spaces
* added notes for sid:517,1867
* updated sid:1634 - added references
* updated sid:1635 - added references
* updated sid:1549 - added references
* updated sid:805 - added references
* updated sid:807 - added references, corrected message
* updated sid:808 - added references
* updated sid:809 - added references, corrected message
* updated sid:810 - added references, corrected message
* updated sid:815 - added references
* updated sid:838 - added references
* updated sid:1454 - added references
* updated sid:853 - added references
* updated sid:861 - added references
* updated sid:867 - added references
* updated sid:896 - added references, corrected message
* updated sid:900 - added references
* updated sid:901 - added references
* updated sid:1482 - added references
* updated sid:1125 - added references
* updated sid:1126 - removed extra spaces
* updated sid:1158 - added references
* updated sid:1231 - added references, moved to be near 1232
* updated sid:1232 - added references
* updated sid:1499 - added references

* added the following signatures:
1857 || WEB-MISC robot.txt access || nessus,10302
1858 || EXPERIMENTAL WEB-MISC CISCO PIX Firewall Manager directory traversal attempt || nessus,10819 || bugtraq,691
1859 || EXPERIMENTAL WEB-MISC Sun JavaServer default password login attempt || nessus,10995
1860 || EXPERIMENTAL WEB-MISC Linksys router default password login attempt \(\:admin\) || nessus,10999
1861 || EXPERIMENTAL WEB-MISC Linksys router default password login attempt \(admin\:admin\) || nessus,10999
1862 || EXPERIMENTAL WEB-CGI mrtg.cgi directory traversal attempt || nessus,11001
1863 || EXPERIMENTAL WEB-CGI mrtg.cgi access || nessus,11001
1864 || EXPERIMENTAL FTP SITE NEWER attempt || nessus,10319 || cve,CVE-1999-0880
1865 || WEB-CGI webdist.cgi arbitrary command attempt || nessus,10299 || cve,CVE-1999-0039 || bugtraq,374
1866 || POP3 USER overflow attempt || :nessus,10311 || cve,CVE-1999-0494
1867 || MISC xdmcp info query || nessus,10891
Revision 1.31 / (view) - annotate - [select for diffs] , Thu Aug 8 02:15:14 2002 UTC (7 years, 7 months ago) by cazz
Branch: MAIN
CVS Tags: beta-1_9_0-beta6
Changes since 1.30: +3 -3 lines
Diff to previous 1.30 
* added support for $AIM_SERVERS for ease of maintaince of AIM server lists.

Thanks to Ian Macdonald for the updated list of servers
Revision 1.30 / (view) - annotate - [select for diffs] , Wed Jun 5 14:59:51 2002 UTC (7 years, 9 months ago) by cazz
Branch: MAIN
CVS Tags: beta-1_9_0-beta2
Changes since 1.29: +2 -2 lines
Diff to previous 1.29 
* yeah, so this was supposed to be on this last commit...
Revision 1.29 / (view) - annotate - [select for diffs] , Wed May 15 12:45:32 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.28: +8 -8 lines
Diff to previous 1.28 
woohoo.  Biggest change we've made in a while.  We've removed "flags:A+"
in favor of "flow:established".  Initial testing shows that this change
is about a 200% speed increase.

NOTE: I know that not all of the signatures have been converted.  There are
144 signatures with flags left to be looked at.  I'll commit them later today,
but this the majority of them.
Revision 1.28 / (view) - annotate - [select for diffs] , Sun May 12 23:14:00 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.27: +2 -1 lines
Diff to previous 1.27 
* removed sid:1749 - duplicate of sid:1660
* updated sid:1426,1427 - added URL ref
* updated sid:1668 - corrected spelling mistake

Added signatures:
* 1752 || MISC AIM AddExternalApp attempt || url,www.w00w00.org/files/w00aimexp/
Revision 1.27 / (view) - annotate - [select for diffs] , Wed May 1 21:52:14 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.26: +1 -2 lines
Diff to previous 1.26 
* cleaned up chat.rules info
* moved all .cgi rules from  web-misc to web-cgi
* moved sid:609 - moved to web-misc
* updated sid:1464 - no, oracle isn't usually thought of as a web server
* updated sid:1423,1425,1497,1667,1500,1619,1519,1520,1521,1522,1523,1524,1525,1526,1527,1540,1554,1545,1546,1551,1552,1559,1560,1561,1563,1564,1567,1568,1603,1618,1626,1642,1643,1668,1669,1670,1671 - s/HOME_NET/HTTP_SERVERS
Revision 1.26 / (view) - annotate - [select for diffs] , Sat Apr 20 19:32:41 2002 UTC (7 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.25: +1 -2 lines
Diff to previous 1.25 
I'd like to dedicate this commit to Don "Beetle" Bailey, who I carpool with
every day.  Its a great thing because this allows me a chance to catch up on
email, update signatures, and get away from annoying questions about why ACID
won't install.  The ride in the mustang is usually very enjoyable just as
long as trees are not involved.  That, and it gives Don and I a chance to rant
about our wives. ;)

* moved sid:499 - moved to icmp.rules

* updated sid:540 - s/info/chat/
* updated sid:541 - s/info/chat/
* updated sid:542 - s/info/chat/
* updated sid:573 - added CVE ref
* updated sid:821 - added CVE ref
* updated sid:857 - added CVE ref
* updated sid:889 - added URL ref
* updated sid:890 - added URL ref
* updated sid:953 - updated msgs
* updated sid:974 - corrected content, made it uricontent as well
* updated sid:993 - corrected content (/iisadmin sometimes isn't in scripts)
* updated sid:999 - corrected msg
* updated sid:1031 - updated msg (less overlapping names)
* updated sid:1123 - made content uricontent
* updated sid:1145 - corrected MSG
* updated sid:1158 - updated content checks (not look for usage, just access)
* updated sid:1193 - corrected content checks, they were completely wrong
* updated sid:1222 - moved to correct .rules (web.cgi)
* updated sid:1463 - s/info/chat/

* disabled the following signatures:
sid:1073
We should not for specific vulnerabilities in "/scripts/samples/" unless you
*really* want to.  we have enough port 80 sigs, lets try and keep em to a
minimum to stay secure, yet still catch badguys.

sid:999
Why look for bdir.htr in that specific place only when it can show up elsewhere?

* added the following signatures:
1638 || EXPERIMENTAL SCAN SSH Version map attempt
1639 || CHAT IRC DCC file transfer request
1640 || CHAT IRC DCC chat request
1641 || EXPERIMENTAL DOS DB2 dos attempt
1642 || EXPERIMENTAL WEB-CGI document.d2w access || bugtraq:2017 || cve,CAN-2000-1110
1643 || EXPERIMENTAL WEB-CGI db2www access || cve,CVE-2000-0677
1644 || WEB-CGI test-cgi attempt || arachnids,218 || cve,CVE-1999-0070
1645 || WEB-CGI testcgi access
1646 || WEB-CGI test.cgi access
1647 || WEB-CGI faxsurvey attempt (full path) || bugtraq,2056 || cve,CVE-1999-0262
1648 || WEB-CGI perl.exe command attempt || arachnids,219 || url,www.cert.org/advisor
ies/CA-1996-11.html || cve,CAN-1999-0509
1649 || WEB-CGI perl command attempt || arachnids,219 || url,www.cert.org/advisories/CA-1996-11.html || cve,CAN-1999-0509
1650 || WEB-CGI tst.bat access || bugtraq,770 || cve,CAN-1999-0885
1651 || WEB-CGI enivorn.pl access
1652 || WEB-CGI campus attempt
1653 || WEB-CGI campus access
1654 || WEB-CGI cart32.exe access
1655 || WEB-CGI pfdispaly.cgi arbitrary command execution attempt
1656 || WEB-CGI pfdispaly.cgi access
1657 || WEB-CGI pagelog.cgi directory traversal attempt || bugtraq,1864 || cve,CAN-2000-0940
1658 || WEB-CGI pagelog.cgi access || bugtraq,1864 || cve,CAN-2000-0940
1659 || WEB-COLDFUSION sendmail.cfm access
1660 || WEB-IIS trace.axd access
1661 || WEB-IIS cmd32.exe access
1662 || WEB-MISC /~ftp access
1663 || WEB-MISC *%0a.pl access
1664 || WEB-MISC mkplog.exe access
1665 || WEB-MISC mkilog.exe access
Revision 1.25 / (view) - annotate - [select for diffs] , Sat Mar 23 14:40:20 2002 UTC (7 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.24: +9 -11 lines
Diff to previous 1.24 
* Added the following signatures:
1428 || EXPERIMENTAL audio galaxy keepalive
1429 || EXPERIMENTAL poll.gotomypc.com access || url,www.gotomypc.com/help2.tmpl
1430 || EXPERIMENTAL TELNET solaris memory mismanagement exploit attempt
1431 || EXPERIMENTAL BAD TRAFFIC syn to multicast address
1432 || INFO GNUTella GET
1433 || WEB-MISC .history access
1434 || WEB-MISC .bash_history access
1435 || DNS named authors attempt || arachnids,480
1436 || MULTIMEDIA Quicktime User Agent access
1437 || MULTIMEDIA Windows Media audio download
1438 || MULTIMEDIA Windows Media Video download
1439 || MULTIMEDIA Shoutcast playlist redirection
1440 || MULTIMEDIA Icecast playlist redirection
1441 || TFTP GET nc.exe
1442 || TFTP GET shadow
1443 || TFTP GET passwd
1444 || TFTP Get
1445 || FTP file_id.diz access
1446 || SMTP vrfy root

* Massive flow updates.  I hope nobody is using these signatures with 1.8.*
Revision 1.24 / (view) - annotate - [select for diffs] , Sat Mar 2 05:19:23 2002 UTC (8 years ago) by cazz
Branch: MAIN
Changes since 1.23: +2 -1 lines
Diff to previous 1.23 
* moved a bunch of experimental rules to their final resting place
* regenerated sid-msg.map
Revision 1.23 / (view) - annotate - [select for diffs] , Fri Jan 4 20:29:29 2002 UTC (8 years, 2 months ago) by cazz
Branch: MAIN
Changes since 1.22: +2 -2 lines
Diff to previous 1.22 
* updated sid:1384 - WTF is with HTTP over UDP?  Microsoft, you suck.
Revision 1.22 / (view) - annotate - [select for diffs] , Wed Dec 26 13:26:29 2001 UTC (8 years, 2 months ago) by cazz
Branch: MAIN
Changes since 1.21: +2 -1 lines
Diff to previous 1.21 
* added SPNP location overflow sig.  The sig is generic in nature, but doesn't
  false often on a crouded XP network.  (tis ment more as a stop gap until
  more research is done into UPNP)
Revision 1.21 / (view) - annotate - [select for diffs] , Fri Dec 21 21:15:48 2001 UTC (8 years, 2 months ago) by cazz
Branch: MAIN
Changes since 1.20: +2 -1 lines
Diff to previous 1.20 
* added UPNP, mod-plsql, and ms-sql raiserror signatures
Revision 1.20 / (view) - annotate - [select for diffs] , Mon Oct 29 01:52:54 2001 UTC (8 years, 4 months ago) by roesch
Branch: MAIN
Changes since 1.19: +2 -1 lines
Diff to previous 1.19 
* Added copyright notices so that the Intrusion.com people might take our intellectual
  property a bit more seriously
Revision 1.19 / (view) - annotate - [select for diffs] , Sun Oct 7 21:19:05 2001 UTC (8 years, 5 months ago) by cazz
Branch: MAIN
Changes since 1.18: +1 -4 lines
Diff to previous 1.18 
* regen sid-msg.map
* move more BAD TRAFFIC sigs into bad-traffic.rules
* remove duplicate .eml signatures
* add txt2html attempt signatures
* add store.cgi attempt & access signatures
Revision 1.18 / (view) - annotate - [select for diffs] , Fri Oct 5 21:06:34 2001 UTC (8 years, 5 months ago) by roesch
Branch: MAIN
Changes since 1.17: +3 -1 lines
Diff to previous 1.17 
* added ICMP type/code logging to unified alerts
Revision 1.17 / (view) - annotate - [select for diffs] , Mon Oct 1 18:57:15 2001 UTC (8 years, 5 months ago) by roesch
Branch: MAIN
Changes since 1.16: +1 -2 lines
Diff to previous 1.16 
* dumped SID's 464 and 515 for gratuitous stupidity
* added proper $EXTERNAL_NET and $HOME_NET info to icmp-info.rules
Revision 1.16 / (view) - annotate - [select for diffs] , Tue Sep 25 04:07:41 2001 UTC (8 years, 5 months ago) by cazz
Branch: MAIN
Changes since 1.15: +2 -11 lines
Diff to previous 1.15 
* Added descriptions to many of the .rules files.  (More to come soon)
* cleaned up a few any any rules
* cleaned up the name of a few rules
* Created attack-responces.rules (for generic responces of known attacks)
* Created bad-traffic.rules (for signatures that shouldn't happen on a
  'good' network)
* normalized a few msgs.
* changed order telnet.rules to speed up the exploit signatures
* added sml3com access signature (need to write an overflow attempt sig,
  but don't have a 3com router to test it.  any takers?)
Revision 1.15 / (view) - annotate - [select for diffs] , Wed Sep 19 12:43:47 2001 UTC (8 years, 6 months ago) by cazz
Branch: MAIN
Changes since 1.14: +2 -1 lines
Diff to previous 1.14 
* added readme.eml autoload atttempt signature
(credit : Farm9)
* added TFTP GET Admin.dll signature
(credit : Farm9)
* added /_vti_bin/ signature
* added CERT references to all NIMDA specific signatures
Revision 1.14 / (view) - annotate - [select for diffs] , Sun Jul 29 16:36:35 2001 UTC (8 years, 7 months ago) by cazz
Branch: MAIN
Changes since 1.13: +3 -3 lines
Diff to previous 1.13 
* Added CVE & Bugtraq references to a few zillion rules.
* Fixed sid:1048 (caught by John Berkers)
Revision 1.13 / (view) - annotate - [select for diffs] , Mon Jul 16 14:19:50 2001 UTC (8 years, 8 months ago) by cazz
Branch: MAIN
Changes since 1.12: +1 -2 lines
Diff to previous 1.12 
 * cleaned up FTP RETR rules
 * cleaned up FTP/TELNET bad login rules
 * removed duplicate HP PJL rules
Revision 1.12 / (view) - annotate - [select for diffs] , Thu Jul 5 02:47:31 2001 UTC (8 years, 8 months ago) by roesch
Branch: MAIN
Changes since 1.11: +2 -2 lines
Diff to previous 1.11 
* fixed window size code, should work better and alert less now...
* began adding portscan detection routines...
Revision 1.11 / (view) - annotate - [select for diffs] , Mon Jul 2 23:23:28 2001 UTC (8 years, 8 months ago) by cazz
Branch: MAIN
Changes since 1.10: +4 -4 lines
Diff to previous 1.10 
* use ':1023' to mean '<1024'

(Thanks to Phil Wood for noticing it, and then reminding me about it again)
Revision 1.10 / (view) - annotate - [select for diffs] , Thu Jun 21 22:22:19 2001 UTC (8 years, 9 months ago) by roesch
Branch: MAIN
Changes since 1.9: +2 -2 lines
Diff to previous 1.9 
* added new command line switch -k, sets checksum verification modes
* added new command line switch -z, used in concert with spp_stream4 it
  allows snort to perform stateful inspection and only fire alerts when
  packets that are part of an established TCP session come in
* added spp_stream4, experimental stateful inspection and stream reassembly,
  stil in the works, use at your own risk!
Revision 1.9 / (view) - annotate - [select for diffs] , Mon Jun 11 15:29:30 2001 UTC (8 years, 9 months ago) by cazz
Branch: MAIN
Changes since 1.8: +31 -32 lines
Diff to previous 1.8 
* added support for SID and REV.
* added sid-msg.map (maps SID to MSG)

SID is a unique ID for each rule.  REV is the rule revision.
Revision 1.8 / (view) - annotate - [select for diffs] , Wed Jun 6 02:25:18 2001 UTC (8 years, 9 months ago) by cazz
Branch: MAIN
Changes since 1.7: +8 -1 lines
Diff to previous 1.7 
Added the following rules:
* DOS JOLT attack
* DOS Land attack
* DOS Teardrop attack
* DOS UDP bomb attack
* DOS IGMP attack (two rules)
* MISC Tiny Fragments
* MISC IP Reserved bit set
* MISC TCP port 0 traffic
* MISC UDP port 0 traffic
* MISC data in TCP SYN packet
* MISC same SRC/DST
* MISC loopback traffic (127.0.0.0/8)
* SMTP RCPT overflow
* WEB-CGI hyperseek directory traversal attempt
* WEB-MISC netscape enterprise server DOS (REVLOG /)
* WEB-MISC netscape enterprise server directory listing (INDEX /)
* WEB-MISC iPlanet DOS attempt
* WEB-MISC WebPALS attempt (two rules)
* WEB-MISC ROADS attempt
Revision 1.7 / (view) - annotate - [select for diffs] , Tue Apr 17 03:32:46 2001 UTC (8 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.6: +25 -46 lines
Diff to previous 1.6 
* Changed default $HOME_NET to any (watch as marty changes it right back :P)
* Added classifications to almost every rule

NOTE:
We are currently using IDMEF's classifications.  This may change soon.
This is an extremely SIMPLE and well defined set of rule classifications
and priorities.  It is completely changeable.  Read sp_priority and
classification.conf for more information.
Revision 1.6 / (view) - annotate - [select for diffs] , Mon Apr 16 03:03:38 2001 UTC (8 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.5: +1 -4 lines
Diff to previous 1.5 
Don't let vim add $ Log $ when I don't tell it to
Revision 1.5 / (view) - annotate - [select for diffs] , Sat Apr 7 22:55:50 2001 UTC (8 years, 11 months ago) by roesch
Branch: MAIN
Changes since 1.4: +4 -2 lines
Diff to previous 1.4 
* fixed http_decode modified data writes
Revision 1.4 / (view) - annotate - [select for diffs] , Wed Apr 4 23:07:50 2001 UTC (8 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.3: +25 -24 lines
Diff to previous 1.3 
Added x11.rules, x11.rules, and virus.rules
Revision 1.3 / (view) - annotate - [select for diffs] , Thu Mar 29 23:00:20 2001 UTC (8 years, 11 months ago) by roesch
Branch: MAIN
Changes since 1.2: +2 -2 lines
Diff to previous 1.2 
* fixed an ancient severe bug in the OR pattern matcher that could cause
  a false negative condition
Revision 1.2 / (view) - annotate - [select for diffs] , Mon Mar 26 02:00:31 2001 UTC (8 years, 11 months ago) by roesch
Branch: MAIN
Changes since 1.1: +2 -1 lines
Diff to previous 1.1 
* Many changes, read the diffs or see the mailing list
Revision 1.1 / (view) - annotate - [select for diffs] , Sat Mar 10 15:42:09 2001 UTC (9 years ago) by roesch
Branch: MAIN 
* Disabled reseerved bits scan detection, false positives for ECN traffic
  aren't detectable with the current code and I'm seeing a lot of noise
  out there about this...
* committed the new rules set from Forster/Caswell
This form allows you to request diffs between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.

Diffs between and
Type of Diff should be a
View only Branch:
Sort log by:
snort-team@sourcefire.com