CVS log for snort/rules/rpc.rules

 (logo)

Help
(back) Up to [cvs] / snort / rules

Request diff between arbitrary revisions

Default branch: MAIN
Bookmark a link to: HEAD / (download)
Revision 1.61 / (view) - annotate - [select for diffs] , Thu Feb 10 01:11:04 2005 UTC (5 years, 1 month ago) by bmc
Branch: MAIN
CVS Tags: HEAD
Changes since 1.60: +0 -0 lines
Diff to previous 1.60 
a bunch of new rules.  thanks microsoft, I didn't want to sleep on my birthday.  Really.
Revision 1.60 / (view) - annotate - [select for diffs] , Wed Jan 12 15:46:11 2005 UTC (5 years, 2 months ago) by bmc
Branch: MAIN
Changes since 1.59: +1 -1 lines
Diff to previous 1.59 
a bunch of new rules.  go sourcefire.
Revision 1.59 / (view) - annotate - [select for diffs] , Wed Oct 13 20:26:07 2004 UTC (5 years, 5 months ago) by bmc
Branch: MAIN
Changes since 1.58: +2 -2 lines
Diff to previous 1.58 
tons of new rules, tons of rule updates.  oracle & nntp xpat rules are the important ones
Revision 1.58.2.1 / (view) - annotate - [select for diffs] , Wed Oct 13 20:25:57 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_3
CVS Tags: STABLE, SNORT_v2_3_0-RC2, SNORT_v2_3_0-RC1, SNORT_v2_3_0
Changes since 1.58: +2 -2 lines
Diff to previous 1.58 to next main 1.59 
tons of new rules, tons of rule updates.  oracle & nntp xpat rules are the important ones
Revision 1.55.2.3 / (view) - annotate - [select for diffs] , Wed Oct 13 20:25:47 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_2
Changes since 1.55.2.2: +2 -2 lines
Diff to previous 1.55.2.2 to branch point 1.55 to next main 1.56 
tons of new rules, tons of rule updates.  oracle & nntp xpat rules are the important ones
Revision 1.49.2.7 / (view) - annotate - [select for diffs] , Wed Oct 13 20:25:36 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_1
Changes since 1.49.2.6: +2 -2 lines
Diff to previous 1.49.2.6 to branch point 1.49 to next main 1.50 
tons of new rules, tons of rule updates.  oracle & nntp xpat rules are the important ones
Revision 1.46.2.7 / (view) - annotate - [select for diffs] , Wed Oct 13 20:25:25 2004 UTC (5 years, 5 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.46.2.6: +2 -2 lines
Diff to previous 1.46.2.6 to branch point 1.46 to next main 1.47 
tons of new rules, tons of rule updates.  oracle & nntp xpat rules are the important ones
Revision 1.46.2.6 / (view) - annotate - [select for diffs] , Fri Sep 10 18:32:47 2004 UTC (5 years, 6 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.46.2.5: +1 -2 lines
Diff to previous 1.46.2.5 to branch point 1.46 
* dedup
Revision 1.55.2.2 / (view) - annotate - [select for diffs] , Tue Aug 10 13:52:06 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_2
CVS Tags: SNORT_v2_2_0
Changes since 1.55.2.1: +1 -1 lines
Diff to previous 1.55.2.1 to branch point 1.55 
* sync sync sync
Revision 1.46.2.5 / (view) - annotate - [select for diffs] , Fri Jul 23 20:32:40 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.46.2.4: +2 -2 lines
Diff to previous 1.46.2.4 to branch point 1.46 
* sync ysnc ysnc sync ysnc ysnc sync ysnc ysnc sync ysnc ysnc
Revision 1.49.2.6 / (view) - annotate - [select for diffs] , Fri Jul 23 20:26:27 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_1
Changes since 1.49.2.5: +2 -2 lines
Diff to previous 1.49.2.5 to branch point 1.49 
* new rules
Revision 1.55.2.1 / (view) - annotate - [select for diffs] , Fri Jul 23 20:19:25 2004 UTC (5 years, 7 months ago) by bmc
Branch: SNORT_2_2
Changes since 1.55: +2 -2 lines
Diff to previous 1.55 
* massive sync here too
Revision 1.58 / (view) - annotate - [select for diffs] , Fri Jul 23 20:15:44 2004 UTC (5 years, 7 months ago) by bmc
Branch: MAIN
Branch point for: SNORT_2_3
Changes since 1.57: +2 -2 lines
Diff to previous 1.57 
* sync sync sync
* go ruleteam go
Revision 1.46.2.4 / (view) - annotate - [select for diffs] , Thu Jul 15 19:14:33 2004 UTC (5 years, 8 months ago) by bmc
Branch: SNORT_2_0
Changes since 1.46.2.3: +131 -130 lines
Diff to previous 1.46.2.3 to branch point 1.46 
* massive sync from head
Revision 1.57 / (view) - annotate - [select for diffs] , Thu Jul 15 16:21:28 2004 UTC (5 years, 8 months ago) by bmc
Branch: MAIN
Changes since 1.56: +55 -55 lines
Diff to previous 1.56 
* yet another sync, lets go forward in time, not backwards...
Revision 1.56 / (view) - annotate - [select for diffs] , Wed Jul 14 21:16:10 2004 UTC (5 years, 8 months ago) by bmc
Branch: MAIN
Changes since 1.55: +55 -55 lines
Diff to previous 1.55 
* massive rule updates (go ruleteam, go)
Revision 1.49.2.5 / (view) - annotate - [select for diffs] , Wed Jun 16 15:11:07 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: SNORT_2_1
Changes since 1.49.2.4: +54 -54 lines
Diff to previous 1.49.2.4 to branch point 1.49 
* Syncing changes for rules team
Revision 1.55 / (view) - annotate - [select for diffs] , Tue Jun 15 13:47:08 2004 UTC (5 years, 9 months ago) by bmc
Branch: MAIN
CVS Tags: SNORT_v2_2_0-RC1
Branch point for: SNORT_2_2
Changes since 1.54: +55 -55 lines
Diff to previous 1.54 
* lets try this *again*
Revision 1.54 / (view) - annotate - [select for diffs] , Thu Jun 3 20:11:05 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: MAIN
Changes since 1.53: +131 -131 lines
Diff to previous 1.53 
* sync with sforge current
Revision 1.49.2.4 / (view) - annotate - [select for diffs] , Thu Jun 3 18:13:38 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: SNORT_2_1
CVS Tags: SNORT_v2_1_3
Changes since 1.49.2.3: +130 -130 lines
Diff to previous 1.49.2.3 to branch point 1.49 
* updating 2.1.3 from sforge
Revision 1.49.2.3 / (view) - annotate - [select for diffs] , Fri May 28 19:21:41 2004 UTC (5 years, 9 months ago) by jhewlett
Branch: SNORT_2_1
Changes since 1.49.2.2: +2 -2 lines
Diff to previous 1.49.2.2 to branch point 1.49 
* syncing up sfire with sforge 2.1 branch
Revision 1.53 / (view) - annotate - [select for diffs] , Sun Apr 18 20:32:59 2004 UTC (5 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.52: +2 -2 lines
Diff to previous 1.52 
* a ton of new rules, a bunch of updates too.

2447 || WEB-MISC ServletManager access || cve,CAN-2001-1195 || nessus,12122
2448 || WEB-MISC setinfo.hts access || bugtraq,9973 || nessus,12120
2449 || FTP ALLO overflow attempt || bugtraq,9953
2450 || CHAT Yahoo IM successful logon
2451 || CHAT Yahoo IM voicechat
2452 || CHAT Yahoo IM ping
2453 || CHAT Yahoo IM conference invitation
2454 || CHAT Yahoo IM conference logon success
2455 || CHAT Yahoo IM conference message
2456 || CHAT Yahoo IM file transfer request
2457 || CHAT Yahoo IM message
2458 || CHAT Yahoo IM successful chat join
2459 || CHAT Yahoo IM webcam offer invitation
2460 || CHAT Yahoo IM webcam request
2461 || CHAT Yahoo IM webcam watch
2462 || EXPLOIT IGMP IGAP account overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2463 || EXPLOIT IGMP IGAP message overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2464 || EXPLOIT EIGRP prefix length overflow attempt || bugtraq,9952 || cve,CAN-2004-0176
2465 || NETBIOS SMB-DS IPC$ share access
2466 || NETBIOS SMB-DS IPC$ share unicode access
2467 || NETBIOS SMB D$ share unicode access
2468 || NETBIOS SMB-DS D$ share access
2469 || NETBIOS SMB-DS D$ share unicode access
2470 || NETBIOS SMB C$ share unicode access
2471 || NETBIOS SMB-DS C$ share access
2472 || NETBIOS SMB-DS C$ share unicode access
2473 || NETBIOS SMB ADMIN$ share unicode access
2474 || NETBIOS SMB-DS ADMIN$ share access
2475 || NETBIOS SMB-DS ADMIN$ share unicode access
2476 || NETBIOS SMB-DS Create AndX Request winreg attempt
2477 || NETBIOS SMB-DS Create AndX Request winreg unicode attempt
2478 || NETBIOS SMB-DS DCERPC bind winreg attempt
2479 || NETBIOS SMB-DS DCERPC bind winreg unicode attempt
2480 || NETBIOS SMB-DS DCERPC shutdown unicode attempt
2481 || NETBIOS SMB-DS DCERPC shutdown unicode little endian attempt
2482 || NETBIOS SMB-DS DCERPC shutdown attempt
2483 || NETBIOS SMB-DS DCERPC shutdown little endian attempt
2484 || WEB-MISC source.jsp access || nessus,12119
2485 || WEB-CLIENT Nortan antivirus sysmspam.dll load attempt || bugtraq,9916
2486 || DOS ISAKMP invalid identification payload attempt || bugtraq,10004
2487 || SMTP WinZip MIME content-type buffer overflow || bugtraq,9758
2488 || SMTP WinZip MIME content-disposition buffer overflow || bugtraq,9758
2489 || EXPLOIT esignal STREAMQUOTE buffer overflow attempt || bugtraq,9978
2490 || EXPLOIT esignal SNAPQUOTE buffer overflow attempt || bugtraq,9978
2491 || NETBIOS SMB-DS DCERPC ISystemActivator unicode bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2492 || NETBIOS SMB DCERPC ISystemActivator bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2493 || NETBIOS SMB DCERPC ISystemActivator unicode bind attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2494 || NETBIOS DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2495 || NETBIOS SMB DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2496 || NETBIOS SMB-DS DCEPRC ORPCThis request flood attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2003-0813
2497 || IMAP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2498 || IMAP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2499 || MISC LDAP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2500 || MISC LDAP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2501 || POP3 invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2502 || POP3 invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2503 || SMTP invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2504 || SMTP invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2505 || WEB-MISC invalid SSLv3 data version attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
2506 || WEB-MISC invalid SSLv3 timestamp attempt || url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx || cve,CAN-2004-0120
Revision 1.52 / (view) - annotate - [select for diffs] , Sat Mar 20 21:58:43 2004 UTC (6 years ago) by cazz
Branch: MAIN
Changes since 1.51: +2 -2 lines
Diff to previous 1.51 
* Added a ton of rules that include vulnerabilities in many high-profile
  security products, including Checkpoint & ISS gear (see below)
* provided a single high-powered rule for detecting all of the evil virus emails
* added even more docs.  (Go Nigel)

2405 || WEB-PHP phptest.php access || bugtraq,9737
2406 || TELNET APC SmartSlot default admin account attempt || bugtraq,9681
2407 || WEB-MISC util.pl access || bugtraq,9748
2408 || WEB-MISC Invision Power Board search.pl access || bugtraq,9766
2409 || POP3 APOP USER overflow attempt || bugtraq,9794
2410 || WEB-PHP IGeneric Free Shopping Cart page.php access || bugtraq,9773
2411 || WEB-MISC Real Server DESCRIBE buffer overflow attempt || url,www.service.real.com/help/faq/security/rootexploit091103.html || bugtraq,8476
2412 || ATTACK-RESPONSES successful cross site scripting forced download attempt
2413 || EXPLOIT ISAKMP delete hash with empty hash attempt || bugtraq,9416 || bugtraq,CAN-2004-0164
2414 || EXPLOIT ISAKMP initial contact notification without SPI attempt || bugtraq,9416 || bugtraq,CAN-2004-0164
2415 || EXPLOIT ISAKMP second payload initial contact notification without SPI attempt || bugtraq,9416 || bugtraq,CAN-2004-0164
2416 || FTP invalid MDTM command attempt
2417 || FTP format string attempt
2418 || MISC MS Terminal Server no encryption session initiation attmept || url,www.microsoft.com/technet/security/bulletin/MS01-052.asp
2419 || MULTIMEDIA realplayer .ram playlist download attempt
2420 || MULTIMEDIA realplayer .rmp playlist download attempt
2421 || MULTIMEDIA realplayer .smi playlist download attempt
2422 || MULTIMEDIA realplayer .rt playlist download attempt
2423 || MULTIMEDIA realplayer .rp playlist download attempt
2424 || NNTP sendsys overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2425 || NNTP senduuname overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2426 || NNTP version overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2427 || NNTP checkgroups overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2428 || NNTP ihave overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2429 || NNTP sendme overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2430 || NNTP newgroup overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2431 || NNTP rmgroup overflow attempt || bugtraq,9382 || cve,CAN-2004-00045
2432 || NNTP article post without path attempt
2433 || WEB-CGI MDaemon form2raw.cgi overflow attempt || bugtraq,9317
2434 || WEB-CGI MDaemon form2raw.cgi access || bugtraq,9317
2435 || WEB-CLIENT Microsoft emf metafile access || bugtraq,9707
2436 || WEB-CLIENT Microsoft wmf metafile access || bugtraq,9707
2437 || WEB-CLIENT RealPlayer arbitrary javascript command attempt || bugtraq,8453 || bugtraq,9738 || cve,CAN-2003-0726
2438 || WEB-CLIENT RealPlayer playlist file URL overflow attempt || bugtraq,9579
2439 || WEB-CLIENT RealPlayer playlist http URL overflow attempt || bugtraq,9579
2440 || WEB-CLIENT RealPlayer playlist rtsp URL overflow attempt || bugtraq,9579
2441 || WEB-MISC NetObserve authentication bypass attempt || bugtraq,9319
2442 || WEB-MISC Quicktime User-Agent buffer overflow attempt || cve,CAN-2004-0169
2443 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
2444 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
2445 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER last name overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
2446 || EXPLOIT ICQ SRV_MULTI/SRV_META_USER email overflow attempt || url,www.eeye.com/html/Research/Advisories/AD20040318.html
Revision 1.49.2.2 / (view) - annotate - [select for diffs] , Mon Mar 1 15:04:39 2004 UTC (6 years ago) by cazz
Branch: SNORT_2_1
CVS Tags: SNORT_v2_1_3-RC1, SNORT_v2_1_2
Changes since 1.49.2.1: +3 -3 lines
Diff to previous 1.49.2.1 to branch point 1.49 
* sync sync sync
Revision 1.46.2.3 / (view) - annotate - [select for diffs] , Mon Mar 1 14:40:42 2004 UTC (6 years ago) by cazz
Branch: SNORT_2_0
Changes since 1.46.2.2: +3 -3 lines
Diff to previous 1.46.2.2 to branch point 1.46 
* sync new rules downwards
Revision 1.51 / (view) - annotate - [select for diffs] , Fri Feb 27 22:36:19 2004 UTC (6 years ago) by cazz
Branch: MAIN
Changes since 1.50: +3 -3 lines
Diff to previous 1.50 
* 44 new rules, 52 updates.   see snort-sigs mailing list in a few days for the full details.

The cool rules are:
(For ISS buffer overflow detection!)
NETBIOS SMB Session Setup AndX request username overflow attempt
NETBIOS SMB Data Service Session Setup AndX request username overflow attempt
NETBIOS SMB Session Setup AndX request unicode username overflow attempt
NETBIOS SMB Data Service Session Setup AndX request unicode username overflow attempt

(For FW1 ISAKMP buffer overflow detection!)
EXPLOIT ISAKMP first payload certificate request length overflow attempt
EXPLOIT ISAKMP second payload certificate request length overflow attempt
EXPLOIT ISAKMP third payload certificate request length overflow attempt
EXPLOIT ISAKMP forth payload certificate request length overflow attempt
EXPLOIT ISAKMP fifth payload certificate request length overflow attempt
Revision 1.49.2.1 / (view) - annotate - [select for diffs] , Wed Feb 25 16:52:51 2004 UTC (6 years ago) by jh8
Branch: SNORT_2_1
CVS Tags: SNORT_v2_1_1
Changes since 1.49: +2 -2 lines
Diff to previous 1.49 
* Bringing RC1 up to 2.1.1
Revision 1.46.2.2 / (view) - annotate - [select for diffs] , Fri Feb 20 20:39:31 2004 UTC (6 years, 1 month ago) by cazz
Branch: SNORT_2_0
Changes since 1.46.2.1: +2 -2 lines
Diff to previous 1.46.2.1 to branch point 1.46 
* sync sync sync, sync sync sync, sync your rules
Revision 1.50 / (view) - annotate - [select for diffs] , Fri Feb 20 17:16:36 2004 UTC (6 years, 1 month ago) by cazz
Branch: MAIN
Changes since 1.49: +2 -2 lines
Diff to previous 1.49 
* bunch o bunch o updates
Revision 1.46.2.1 / (view) - annotate - [select for diffs] , Tue Nov 25 14:03:27 2003 UTC (6 years, 3 months ago) by cazz
Branch: SNORT_2_0
CVS Tags: version-2-0-6
Changes since 1.46: +134 -127 lines
Diff to previous 1.46 
* major sync from CURRENT.  lots of changes too many to list.  but its all good and stuff.
Revision 1.49 / (view) - annotate - [select for diffs] , Thu Nov 20 20:56:56 2003 UTC (6 years, 4 months ago) by cazz
Branch: MAIN
CVS Tags: version-2-1-0, SNORT_v2_1_1-RC1, SNORT_v2_1_0
Branch point for: SNORT_2_1
Changes since 1.48: +1 -3 lines
Diff to previous 1.48 
* remove backticked things from message.  this tends to fsck up too many tools
Revision 1.48 / (view) - annotate - [select for diffs] , Thu Nov 6 17:28:10 2003 UTC (6 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.47: +3 -1 lines
Diff to previous 1.47 
* sync sid
* sync sid-msg.map
* add sids to rules in rpc.rules that should have had them already.
Revision 1.47 / (view) - annotate - [select for diffs] , Mon Oct 20 15:03:11 2003 UTC (6 years, 5 months ago) by chrisgreen
Branch: MAIN
CVS Tags: cmg
Changes since 1.46: +134 -127 lines
Diff to previous 1.46 
* Major add/commit of 2.1 feature set...

  Will do a tag and then remove the "moved" files
Revision 1.46 / (view) - annotate - [select for diffs] , Fri Jun 13 18:25:02 2003 UTC (6 years, 9 months ago) by cazz
Branch: MAIN
CVS Tags: version-2-0-5, version-2-0-2, version-2-0-1
Branch point for: SNORT_2_0
Changes since 1.45: +4 -6 lines
Diff to previous 1.45 
* added sid:2123 - ATTACK-RESPONSES Microsoft cmd.exe banner
* added sid:2124 - BACKDOOR Remote PC Access connection attempt
* added sid:2125 - FTP CWD C:\\
* added sid:2126 - MISC Microsoft PPTP Start Control Request buffer overflow attempt
* added sid:2127 - WEB-CGI ikonboard.cgi access
* added sid:2128 - WEB-CGI swsrv.cgi access
* added sid:2129 - WEB-IIS nsiislog.dll access
* added sid:2130 - WEB-IIS IISProtect siteadmin.asp access
* added sid:2131 - WEB-IIS IISProtect access
* added sid:2132 - WEB-IIS Synchrologic Email Accelerator userid list access attempt
* added sid:2133 - WEB-IIS MS BizTalk server access
* added sid:2134 - WEB-IIS register.asp access
* added sid:2135 - WEB-MISC philboard.mdb access
* added sid:2136 - WEB-MISC philboard_admin.asp authentication bypass attempt
* added sid:2137 - WEB-MISC philboard_admin.asp access
* added sid:2138 - WEB-MISC logicworks.ini access
* added sid:2139 - WEB-MISC /*.shtml access
* added sid:2140 - WEB-PHP p-news.php access
* added sid:2141 - WEB-PHP shoutbox.php directory traversal attempt
* added sid:2142 - WEB-PHP shoutbox.php access
* added sid:2143 - WEB-PHP b2 cafelog gm-2-b2.php remote command execution attempt
* added sid:2144 - WEB-PHP b2 cafelog gm-2-b2.php access
* added sid:2145 - WEB-PHP TextPortal admin.php default password (admin) attempt
* added sid:2146 - WEB-PHP TextPortal admin.php default password (12345) attempt
* added sid:2147 - WEB-PHP BLNews objects.inc.php4 remote command execution attempt
* added sid:2148 - WEB-PHP BLNews objects.inc.php4 access
* added sid:2149 - WEB-PHP Turba status.php access
* added sid:2150 - WEB-PHP ttCMS header.php remote command execution attempt
* added sid:2151 - WEB-PHP ttCMS header.php access
* added sid:2152 - WEB-PHP test.php access
* added sid:2153 - WEB-PHP autohtml.php directory traversal attempt
* added sid:2154 - WEB-PHP autohtml.php access
* added sid:2155 - WEB-PHP ttforum remote command execution attempt
* added sid:2156 - WEB-MISC mod_gzip_status access
* added sid:2157 - WEB-IIS IISProtect GlobalAdmin.asp access
* added sid:2158 - MISC BGP invalid length
* added sid:2159 - MISC BGP invalid type (0)
* added sid:2160 - VIRUS OUTBOUND .exe file attachment
* added sid:2161 - VIRUS OUTBOUND .doc file attachment
* added sid:2162 - VIRUS OUTBOUND .hta file attachment
* added sid:2163 - VIRUS OUTBOUND .chm file attachment
* added sid:2164 - VIRUS OUTBOUND .reg file attachment
* added sid:2165 - VIRUS OUTBOUND .ini file attachment
* added sid:2166 - VIRUS OUTBOUND .bat file attachment
* added sid:2167 - VIRUS OUTBOUND .diz file attachment
* added sid:2168 - VIRUS OUTBOUND .cpp file attachment
* added sid:2169 - VIRUS OUTBOUND .dll file attachment
* added sid:2170 - VIRUS OUTBOUND .vxd file attachment
* added sid:2171 - VIRUS OUTBOUND .sys file attachment
* added sid:2172 - VIRUS OUTBOUND .com file attachment
* added sid:2173 - VIRUS OUTBOUND .hsq file attachment
* added sid:2174 - NETBIOS SMB winreg access
* added sid:2175 - NETBIOS SMB winreg access (unicode)
* added sid:2176 - NETBIOS SMB Startup Folder access attempt
* added sid:2177 - NETBIOS SMB Startup Folder access attempt (unicode)
Revision 1.45 / (view) - annotate - [select for diffs] , Wed May 14 18:07:57 2003 UTC (6 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.44: +145 -139 lines
Diff to previous 1.44 
* major push of rules.  see snort-sigs email for all the changes.
Revision 1.44 / (view) - annotate - [select for diffs] , Thu Apr 17 00:58:20 2003 UTC (6 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.43: +2 -2 lines
Diff to previous 1.43 
* 2104 is actually 2030.  fixed
Revision 1.43 / (view) - annotate - [select for diffs] , Thu Apr 17 00:35:47 2003 UTC (6 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.42: +167 -109 lines
Diff to previous 1.42 
* MASSIVE sync of rules

This is the first major sync of rules since I started working for Sourcefire.

Many of these updates are a direct result of my employment at Sourcefire.  We
have time and resources to test and document rules extensively.  Many people
have contributed to these updates.  Too many to mention here.

You should continue to see awesome updates, rewrites and new rules as
Sourcefire is dedicating serious resources to the Snort project.

Even if you don't buy an appliance from Sourcefire, you should send an
email to info@sourcefire.com to let them know how much you appreciate their
dedication to making snort awesome.
Revision 1.35.2.4 / (view) - annotate - [select for diffs] , Thu Apr 17 00:22:48 2003 UTC (6 years, 11 months ago) by cazz
Branch: SNORT_1_9
Changes since 1.35.2.3: +2 -2 lines
Diff to previous 1.35.2.3 to branch point 1.35 to next main 1.36 
* happy happy joy joy.  last commit of rules to 1.9

* remove sid:2103 - byte_test don't exist for 1.9.  wtf was i thinking?
* update sid:1955 - sever/server
* update sid:1250 - no more regex
* update sid:1108 - no more regex
Revision 1.42 / (view) - annotate - [select for diffs] , Tue Mar 25 22:09:28 2003 UTC (6 years, 11 months ago) by cazz
Branch: MAIN
CVS Tags: version-2-0-0
Changes since 1.41: +2 -2 lines
Diff to previous 1.41 
* update sid:1845 - add missing offset to byte_test
* update sid:1955 - correct flow, use offset/depth
* update sid:1250 - remove regex
* update sid:1108 - remove regex
Revision 1.41 / (view) - annotate - [select for diffs] , Tue Mar 4 21:56:36 2003 UTC (7 years ago) by cazz
Branch: MAIN
CVS Tags: CMG
Changes since 1.40: +4 -1 lines
Diff to previous 1.40 
* merge more rules
2004 || MS-SQL Worm propagation attempt OUTBOUND
2005 || RPC UDP kcms_server request
2006 || RPC TCP kcms_server request
2007 || RPC kcms_server directory traversal attempt
2008 || MISC CVS invalid user authentication response
2009 || MISC CVS invalid repository response
2010 || MISC CVS double free exploit attempt response || bugtraq,6650 || cve,CAN-2003-0015
2011 || MISC CVS invalid directory response || bugtraq,6650 || cve,CAN-2003-0015
2012 || MISC CVS missing cvsroot response
2013 || MISC CVS invalid module response
Revision 1.35.2.3 / (view) - annotate - [select for diffs] , Tue Mar 4 21:47:54 2003 UTC (7 years ago) by cazz
Branch: SNORT_1_9
Changes since 1.35.2.2: +4 -1 lines
Diff to previous 1.35.2.2 to branch point 1.35 
* merge more rules
2004 || MS-SQL Worm propagation attempt OUTBOUND
2005 || RPC UDP kcms_server request
2006 || RPC TCP kcms_server request
2007 || RPC kcms_server directory traversal attempt
2008 || MISC CVS invalid user authentication response
2009 || MISC CVS invalid repository response
2010 || MISC CVS double free exploit attempt response || bugtraq,6650 || cve,CAN-2003-0015
2011 || MISC CVS invalid directory response || bugtraq,6650 || cve,CAN-2003-0015
2012 || MISC CVS missing cvsroot response
2013 || MISC CVS invalid module response
Revision 1.35.2.2 / (view) - annotate - [select for diffs] , Sun Feb 9 03:27:30 2003 UTC (7 years, 1 month ago) by cazz
Branch: SNORT_1_9
CVS Tags: version-1-9-1
Changes since 1.35.2.1: +58 -45 lines
Diff to previous 1.35.2.1 to branch point 1.35 
* merge the rest of the changes from current.

Most of this done thanks to the large efforts from Frank Knobbe and
Russell Fulton (at least, I think its Fulton :P)

Thanks guys.  (Oh, anyone reading these, send them an email thanking them
for their efforts.)
Revision 1.40 / (view) - annotate - [select for diffs] , Mon Nov 25 01:58:12 2002 UTC (7 years, 3 months ago) by cazz
Branch: MAIN
Changes since 1.39: +64 -20 lines
Diff to previous 1.39 
* updated sid:107 - corrected bad content checks
* updated sid:159 - corrected client/server pair
* updated sid:195 - corrected client/server pair
* updated sid:1929 - (trust me, it changed between 1,2 and 3)
* updated sid:524 - removed invalid references
* updated sid:238 - corrected client/server pair
* updated sid:1257 - added additional ports that can be targetted
* updated sid:306 - added reference
* updated sid:1919 - added references
* updated sid:1734 - added references
* updated sid:361 - added distance to limit false positives
* updated sid:362 - removed RETR content check (can be used with STOR as well)
* updated sid:1377 - added distance to limit false positives
* updated sid:1378 - added distance to limit false positives
* re-enabled sid:1748 - should be on by default
* updated sid:1844 - use byte_test instead of distance
* updated sid:1845 - use byte_test instead of distance
* updated sid:1903 - remove additional un-needed content
* updated sid:1755 - use within
* disabled sid:293 - replaced with other sids
* disabled sid:295 - replaced with other sids
* disabled sid:296 - replaced with other sids
* disabled sid:297 - replaced with other sids
* disabled sid:298 - replaced with other sids
* disabled sid:299 - replaced with other sids
* updated sid:489 - added within
* updated sid:1866 - added references
* disabled sid:570 - replaced with other sids
* disabled sid:571 - replaced with other sids
* updated sid:664 - updated MSG to be more clear
* updated sid:1289 - added offsets
* updated sid:1441 - added offsets
* updated sid:1442 - added offsets
* updated sid:1443 - added offsets
* updated sid:519 - added offsets
* updated sid:1149 - updated MSG to be more clear
* disabled sid:1287 - too false positive to be on by default
* updated sid:1069 - updated MSG to be more clear
* updated sid:1519 - updated MSG to be correct, update content to be correct
* updated sid:1809 - use HTTP_PORTS instead of 80
* updated sid:1826 - correct uricontent
* disabled sid:1171 - too false positive to be on by default

* deleted sid:874 - very bad rule
* deleted sid:318 - replaced by sid:1939 and sid:1940
* deleted sid:319 - replaced by sid:1939 and sid:1940

* reordered rpc.rules to be a bit more clear
* reordered dns.rules to be a bit more clear
* added pop2.rules
* disaabled asn1_decode, as it shouldn't be on by default
* added the following rules:
1929 || BACKDOOR TCPDUMP/PCAP trojan traffic || url,hlug.fscker.com
1930 || IMAP auth overflow attempt || cve,CVE-1999-0005
1931 || WEB-CGI rpc-nlog.pl access || cve,CAN-1999-1278
1932 || WEB-CGI rpc-smb.pl access || cve,CAN-1999-1278
1933 || WEB-CGI cart.cgi access
1934 || POP2 FOLD overflow attempt || cve,CVE-1999-0920 || bugtraq,283
1935 || POP2 FOLD arbitrary file attempt
1936 || POP3 AUTH overflow attempt
1937 || POP3 LIST overflow attempt || cve,CAN-2000-0096 || bugtraq,948
1938 || POP3 XTND overflow attempt
1939 || MISC bootp hardware address lenght overflow || cve,CAN-1999-0798
1940 || MISC bootp invalid hardware type || cve,CAN-1999-0798
1941 || TFTP filename overflow attempt || bugtraq,5328 || cve,CAN-2002-0813
1942 || FTP RMDIR overflow attempt
1943 || WEB-MISC /Carello/add.exe access || bugtraq,1245 || cve,CVE-2000-0396
1944 || WEB-MISC /ecscripts/ecware.exe access
1945 || WEB-IIS unicode directory traversal attempt || cve,CVE-2000-0884
1946 || WEB-MISC answerbook2 admin attempt
1947 || WEB-MISC answerbook2 arbitrary command execution attempt
1948 || DNS zone transfer UDP || arachnids,212 || cve,CAN-1999-0532
1949 || RPC portmap SET attempt TCP 111
1950 || RPC portmap SET attempt UDP 111
1951 || RPC mountd TCP mount request
1952 || RPC mountd UDP export request
1953 || RPC AMD TCP pid request
1954 || RPC AMD UDP pid request
1955 || RPC AMD TCP version request
1956 || RPC AMD UDP version request
1957 || RPC sadmind UDP PING || bugtraq,866
1958 || RPC sadmind TCP PING || bugtraq,866
1959 || RPC portmap request NFS UDP
1960 || RPC portmap request NFS TCP
1961 || RPC portmap request RQUOTA UDP
1962 || RPC portmap request RQUOTA TCP
1963 || RPC RQUOTA UDP getquota overflow attempt || bugtraq,864 || cve,CVE-1999-0974
1964 || RPC tooltalk UDP overflow attempt
1965 || RPC tooltalk TCP overflow attempt
1966 || MISC GlobalSunTech Access Point Information Discolsure attempt || bugtraq,6100
1967 || WEB-PHP phpbb quick-reply.php arbitrary command attempt || bugtraq,6173
1968 || WEB-PHP phpbb quick-reply.php access || bugtraq,6173
1969 || WEB-MISC ion-p access || bugtraq,6091
1970 || WEB-IIS MDAC Content-Type overflow attempt
1971 || FTP SITE EXEC format string attempt
1972 || FTP PASS overflow attempt || cve,CAN-2002-0126 || cve,CAN-2000-1035
1973 || FTP MKD overflow attempt || bugtraq,612 || cve,CAN-1999-0911
1974 || FTP REST overflow attempt || cve,CAN-2001-0826
1975 || FTP DELE overflow attempt || cve,CAN-2001-0826
1976 || FTP RMD overflow attempt || cve,CAN-2001-0826
1977 || WEB-MISC xp_regwrite attempt
1978 || WEB-MISC xp_regdeletekey attempt
1979 || WEB-MISC perl post attempt || nessus,11158 || bugtraq,5520
Revision 1.35.2.1 / (view) - annotate - [select for diffs] , Sun Nov 17 04:40:09 2002 UTC (7 years, 4 months ago) by cazz
Branch: SNORT_1_9
Changes since 1.35: +9 -1 lines
Diff to previous 1.35 
* major sync from current (look ma, no experimental.rules)
* added pop2.rules
* regen sid-msg.map
Revision 1.39 / (view) - annotate - [select for diffs] , Wed Nov 6 13:35:14 2002 UTC (7 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.38: +37 -12 lines
Diff to previous 1.38 
* add my notes to RULES.todo
* delete sid:1620 - spp_conversation takes care of this
* moved sid:1429,1447,1448,1545,1636,1641,1771,1791,1801,1802,1803,1804,1808,
  1810,1811,1812,1819,1821,1832,1838,1842,1843,1844,1845,1902,1903,1904,1846,
  1853,1854,1855,1856,1865,1888,1887,1889,1905,1906,1907,1908,1909,1910,1911,
  1912,1480,1913,1914,1915,1916,1917,1918 to their final resting place.

This marks the end of experimental.rules.  Please take a moment of silence.
Revision 1.38 / (view) - annotate - [select for diffs] , Tue Nov 5 22:20:35 2002 UTC (7 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.37: +10 -5 lines
Diff to previous 1.37 
* updated sid:1907,1908,1909,1911,1912,1913,1914,1915,1916,1917,1918,1923:
  added references
* added the following rules:
1924 || RPC mounted UDP export request || arachnids,26
1925 || RPC mounted TCP exportall request || arachnids,26
1926 || RPC mounted UDP exportall request || arachnids,26
Revision 1.37 / (view) - annotate - [select for diffs] , Tue Nov 5 21:02:00 2002 UTC (7 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.36: +11 -9 lines
Diff to previous 1.36 
* updated sid:1382 - removed dsize, added within
* deleted sid:329 - duplicate of 330
* deleted sid:1477 - duplicate of 1478
* deleted sid:1246 - duplicate of 1248
* deleted sid:1247 - duplicate of 1249
* deleted sid:1171 - broken because of stream reassembly, needs added to httpd decoder
* deleted sid:1104 - broken because of stream reassembly, needs added to httpd decoder
* deleted sid:1087 - broken because of stream reassembly, needs added to httpd decoder
* deleted sid:1780 - duplicate of 1755
* deleted sid:291 - duplicate of 1538
* updated sid:1842 - removed dsize, added within
* updated sid:337 - updated msg, removed dsize, added within
* updated sid:1377 - added CVE references
* updated sid:1378 - added CVE references
* updated sid:1379 - removed dsize, added within
* updated sid:1621 - removed dsize, added within
* updated sid:1529 - removed dsize, added within
* updated sid:1630 - removed dsize, added within
* updated sid:1562 - removed dsize, added within
* updated sid:1734 - removed dsize, added within
* updated sid:1755 - added CVE reference, added within
* updated sid:1388 - removed dsize, added within
* updated sid:1792 - added CVE reference, removed dsize, added within
* updated sid:1538 - added arachnids reference, removed dsize, added within
* updated sid:1866 - removed dsize, added within
* updated sid:1634 - removed dsize, added within
* updated sid:1635 - removed dsize, added within
* disabled sid:596 - soon to be replaced by other rules
* disabled sid:597 - soon to be replaced by other rules
* updated sid:1280 - added within to skip revisions (evasion protection)
* updated sid:598 - added within to skip revisions (evasion protection)
* updated sid:599 - added within to skip revisions (evasion protection)
* updated sid:1281 - added within to skip revisions (evasion protection)
* disabled sid:600 - soon to be replaced by other rules
* disabled sid:1282 - soon to be replaced by other rules
* updated sid:654 - removed dsize, added within
* updated sid:657 - removed dsize, added within
* updated sid:1549 - removed dsize, added within
* updated sid:1550 - removed dsize, added within
* updated sid:804 - removed dsize
* updated sid:821 - removed dsize
* updated sid:1242 - removed dsize
* updated sid:1244 - removed dsize
* updated sid:981:
  - removed "/scripts", attackers can use other directories
  - s/uricontent/content/ (http decoder decodes uricontent, we don't want to
    look at the decoded portion)
* updated sid:982:
  - removed "/scripts", attackers can use other directories
  - s/uricontent/content/ (http decoder decodes uricontent, we don't want to
    look at the decoded portion)
* updated sid:983:
  - removed "/scripts", attackers can use other directories
  - s/uricontent/content/ (http decoder decodes uricontent, we don't want to
    look at the decoded portion)
* updated sid:1044 - removed dsize
* updated sid:1181 - removed dsize
* updated sid:1258 - removed dsize
* updated sid:1260 - removed dsize, added within
* added the following rules:
1902 || EXPERIMENTAL IMAP lsub overflow attempt || cve,CAN-2000-0284 || nessus,10374
1903 || EXPERIMENTAL IMAP rename overflow attempt || cve,CAN-2000-0284 || nessus,10374
1904 || EXPERIMENTAL IMAP find overflow attempt || cve,CAN-2000-0284 || nessus,10374
1905 || RPC AMD UDP amqproc_mount plog overflow attempt || bugtraq,614 || cve,CVE-1999-0704
1906 || RPC AMD TCP amqproc_mount plog overflow attempt || bugtraq,614 || cve,CVE-1999-0704
1907 || RPC CMSD UDP CMSD_CREATE buffer overflow attempt || bugtraq,524 || cve,CVE-1999-0696
1908 || RPC CMSD TCP CMSD_CREATE buffer overflow attempt || bugtraq,524 || cve,CVE-1999-0696
1909 || RPC CMSD TCP CMSD_INSERT buffer overflow attempt || url,www.cert.org/advisories/CA-99-08-cmsd.html || cve,CVE-1999-0696
1910 || RPC CMSD udp CMSD_INSERT buffer overflow attempt || url,www.cert.org/advisories/CA-99-08-cmsd.html || cve,CVE-1999-0696
1911 || RPC sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt || bugtraq,866 || cve,CVE-1999-0977
1912 || RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt || bugtraq,866 || cve,CVE-1999-0977
1913 || RPC STATD UDP stat mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1914 || RPC STATD TCP stat mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1915 || RPC STATD UDP monitor mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1916 || RPC STATD TCP monitor mon_name format string exploit attempt || bugtraq,1480 || cve,CVE-2000-0666
1917 || SCAN UPNP service discover attempt
1918 || SCAN SolarWinds IP scan attempt
1919 || FTP CWD overflow attempt
1920 || FTP SITE NEWER overflow attempt || cve,CVE-1999-0800
1921 || FTP SITE ZIPCHK attempt || cve,CVE-2000-0040
1922 || RPC portmap TCP proxy attempt
1923 || RPC portmap UDP proxy attempt
Revision 1.36 / (view) - annotate - [select for diffs] , Mon Oct 28 22:08:08 2002 UTC (7 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.35: +4 -1 lines
Diff to previous 1.35 
* moved to proper .rules file from experimental.rules:
1605,1504,1890,1891,1638,1822,1823,1824,1825,1868,1869,1870,1875,1876,1877,
1878,1840,1841,1817,1818,1814,1826,1820,1827,1828,1829,1830,1831,1835,1839,
1847,1848,1849,1850,1851,1852,1857,1859,1860,1861,1862,1863,1871,1872,1873,
1874,1881,1815,1816,1834
* updated sid:1337,1338 - correced content, don't include the full path
Revision 1.35 / (view) - annotate - [select for diffs] , Sun Aug 18 20:28:43 2002 UTC (7 years, 7 months ago) by cazz
Branch: MAIN
CVS Tags: version-1-9-0
Branch point for: SNORT_1_9
Changes since 1.34: +3 -2 lines
Diff to previous 1.34 
* large update of signatures.  CVS disconnected during the last commit, so
  this is a recommit
Revision 1.34 / (view) - annotate - [select for diffs] , Wed May 22 00:37:29 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
CVS Tags: beta-1_9_0-beta6, beta-1_9_0-beta5, beta-1_9_0-beta4, beta-1_9_0-beta2
Changes since 1.33: +3 -3 lines
Diff to previous 1.33 
* updated sid:312 - added bugtraq ref
* updated sid:1751 - added CVE ref
* updated sid:499 - corrected MSG
* updated sid:1746,1747 - added cve & BUG references
* updated sid:1547 - removed false negative (print isn't required)
* added the following signatures:
1753 || EXPERIMENTAL WEB-IIS as_web.exe access || bugtraq,4670
1754 || EXPERIMENTAL WEB-IIS as_web4.exe access || bugtraq,4670
1755 || EXPERIMENTAL IMAP PARTIAL BODY attempt
1756 || EXPERIMENTAL WEB-IIS NewsPro administration authentication attempt
1757 || EXPERIMENTAL WEB-MISC b2 arbitrary command execution attempt
1758 || EXPERIMENTAL WEB-MISC b2 acces
1759 || MS-SQL xp_cmdshell program execution (445)
Revision 1.33 / (view) - annotate - [select for diffs] , Wed May 15 12:45:33 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.32: +35 -35 lines
Diff to previous 1.32 
woohoo.  Biggest change we've made in a while.  We've removed "flags:A+"
in favor of "flow:established".  Initial testing shows that this change
is about a 200% speed increase.

NOTE: I know that not all of the signatures have been converted.  There are
144 signatures with flags left to be looked at.  I'll commit them later today,
but this the majority of them.
Revision 1.32 / (view) - annotate - [select for diffs] , Sat May 4 00:53:25 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.31: +5 -3 lines
Diff to previous 1.31 
* removed spaces at the end of a ton of signatures.  Since this isn't technically modifying the sig, I didn't bump the rev.  Any decent parsing program shouldn't bitch at this.
* corrected sid:1747 - corrected msg (said UDP in TCP sig)
* corrected sid:1746 - corrected msg (said TCP in UDP sig)
* corrected sid:1562 - SITE CHOWN sig should look for SITE CHOWN, not USER
* added the following sigs:
1734 || EXPERIMENTAL FTP USER overflow attempt || bugtraq,4638
1735 || EXPERIMENTAL WEB-CLIENT XMLHttpRequest attempt
1736 || EXPERIMENTAL WEB-MISC squirrelmail spellcheck arbitrary command attemp || bugtraq,3952
1737 || EXPERIMENTAL WEB-MISC squirrelmail theme arbitrary command attempt || bugtraq,4385
1738 || EXPERIMENTAL WEB-MISC global.inc access || bugtraq,4612
1739 || EXPERIMENTAL WEB-PHP DNSTools administror authentication bypass attempt || bugtraq,4617
1740 || EXPERIMENTAL WEB-PHP DNSTools authentication bypass attempt || bugtraq,4617
1741 || EXPERIMENTAL WEB-PHP DNSTools access || bugtraq,4617
1742 || EXPERIMENTAL WEB-PHP Blahz-DNS dostuff.php modify user attempt || bugtraq,4618
1743 || EXPERIMENTAL WEB-PHP Blahz-DNS dostuff.php access || bugtraq,4618
1744 || EXPERIMENTAL WEB-MISC SecureSite authentication bypass attempt || bugtraq,4621
1745 || EXPERIMENTAL WEB-PHP Messagerie supp_membre.php access || bugtraq,4635
1746 || RPC UDP cachefsd request
1747 || RPC TCP cachefsd request
1748 || EXPERIMENTAL FTP command overflow attempt
1749 || EXPERIMENTAL WEB-IIS .NET trace.axd access
1750 || EXPERIMENTAL WEB-IIS users.xml access
Revision 1.31 / (view) - annotate - [select for diffs] , Fri May 3 18:03:34 2002 UTC (7 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.30: +3 -1 lines
Diff to previous 1.30 
* removed dup sid (1502)

Added the following signatures:
1729 || CHAT IRC channel join
1730 || WEB-CGI ustorekeeper.pl directory traversal attempt
1731 || WEB-CGI a1stats access || cve,CAN-2001-0561
1732 || RPC TCP rwalld request
1733 || RPC UDP rwalld request
Revision 1.30 / (view) - annotate - [select for diffs] , Sat Apr 20 19:32:41 2002 UTC (7 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.29: +2 -2 lines
Diff to previous 1.29 
I'd like to dedicate this commit to Don "Beetle" Bailey, who I carpool with
every day.  Its a great thing because this allows me a chance to catch up on
email, update signatures, and get away from annoying questions about why ACID
won't install.  The ride in the mustang is usually very enjoyable just as
long as trees are not involved.  That, and it gives Don and I a chance to rant
about our wives. ;)

* moved sid:499 - moved to icmp.rules

* updated sid:540 - s/info/chat/
* updated sid:541 - s/info/chat/
* updated sid:542 - s/info/chat/
* updated sid:573 - added CVE ref
* updated sid:821 - added CVE ref
* updated sid:857 - added CVE ref
* updated sid:889 - added URL ref
* updated sid:890 - added URL ref
* updated sid:953 - updated msgs
* updated sid:974 - corrected content, made it uricontent as well
* updated sid:993 - corrected content (/iisadmin sometimes isn't in scripts)
* updated sid:999 - corrected msg
* updated sid:1031 - updated msg (less overlapping names)
* updated sid:1123 - made content uricontent
* updated sid:1145 - corrected MSG
* updated sid:1158 - updated content checks (not look for usage, just access)
* updated sid:1193 - corrected content checks, they were completely wrong
* updated sid:1222 - moved to correct .rules (web.cgi)
* updated sid:1463 - s/info/chat/

* disabled the following signatures:
sid:1073
We should not for specific vulnerabilities in "/scripts/samples/" unless you
*really* want to.  we have enough port 80 sigs, lets try and keep em to a
minimum to stay secure, yet still catch badguys.

sid:999
Why look for bdir.htr in that specific place only when it can show up elsewhere?

* added the following signatures:
1638 || EXPERIMENTAL SCAN SSH Version map attempt
1639 || CHAT IRC DCC file transfer request
1640 || CHAT IRC DCC chat request
1641 || EXPERIMENTAL DOS DB2 dos attempt
1642 || EXPERIMENTAL WEB-CGI document.d2w access || bugtraq:2017 || cve,CAN-2000-1110
1643 || EXPERIMENTAL WEB-CGI db2www access || cve,CVE-2000-0677
1644 || WEB-CGI test-cgi attempt || arachnids,218 || cve,CVE-1999-0070
1645 || WEB-CGI testcgi access
1646 || WEB-CGI test.cgi access
1647 || WEB-CGI faxsurvey attempt (full path) || bugtraq,2056 || cve,CVE-1999-0262
1648 || WEB-CGI perl.exe command attempt || arachnids,219 || url,www.cert.org/advisor
ies/CA-1996-11.html || cve,CAN-1999-0509
1649 || WEB-CGI perl command attempt || arachnids,219 || url,www.cert.org/advisories/CA-1996-11.html || cve,CAN-1999-0509
1650 || WEB-CGI tst.bat access || bugtraq,770 || cve,CAN-1999-0885
1651 || WEB-CGI enivorn.pl access
1652 || WEB-CGI campus attempt
1653 || WEB-CGI campus access
1654 || WEB-CGI cart32.exe access
1655 || WEB-CGI pfdispaly.cgi arbitrary command execution attempt
1656 || WEB-CGI pfdispaly.cgi access
1657 || WEB-CGI pagelog.cgi directory traversal attempt || bugtraq,1864 || cve,CAN-2000-0940
1658 || WEB-CGI pagelog.cgi access || bugtraq,1864 || cve,CAN-2000-0940
1659 || WEB-COLDFUSION sendmail.cfm access
1660 || WEB-IIS trace.axd access
1661 || WEB-IIS cmd32.exe access
1662 || WEB-MISC /~ftp access
1663 || WEB-MISC *%0a.pl access
1664 || WEB-MISC mkplog.exe access
1665 || WEB-MISC mkilog.exe access
Revision 1.29 / (view) - annotate - [select for diffs] , Sun Apr 14 22:52:48 2002 UTC (7 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.28: +2 -2 lines
Diff to previous 1.28 
* updated sid:258 - added bugtraq ref
* updated sid:259 - added bugtraq ref
* updated sid:260 - added bugtraq ref
* updated sid:275 - added bugtraq ref
* updated sid:1622 - corrected content to look for RNFR
* updated sid:315 - added bugtraq ref
* updated sid:316 - added bugtraq ref
* updated sid:317 - added bugtraq ref
* updated sid:588 - added bugtraq ref
* updated sid:806 - added bugtraq ref, corrected MSG
* updated sid:1395 - added bugtraq ref
* updated sid:1396 - added bugtraq ref
* updated sid:1242 - added bugtraq ref
* updated sid:1245 - added bugtraq ref
* updated sid:1037 - added bugtraq ref
* Added the following signatures:
1630 || EXPERIMENTAL FTP EXPLOIT CWD overflow
1631 || MISC AIM login
1632 || MISC AIM send message
1633 || MISC AIM recieve message
1634 || EXPERIMENTAL POP3 PASS overflow attempt || cve,CAN-1999-1511
1635 || EXPERIMENTAL POP3 APOP overflow attempt || cve,CAN-2000-0841
1636 || MISC Xtramail Username overflow attempt || bugtraq,791 || cve,CAN-1999-511
1637 || WEB-CGI yabb.cgi access || bugtraq,1668 || arachnids,462 || cve,CVE-2000-0853
Revision 1.28 / (view) - annotate - [select for diffs] , Sun Apr 7 16:52:28 2002 UTC (7 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.27: +3 -3 lines
Diff to previous 1.27 
* updated sid:577 - added CVE ref
* updated sid:1264 - added CVE ref
* updated sid:817 - corrected name
* updated sid:1466 - corrected classtype
* updated sid:1467 - corrected classtype
* updated sid:908 - added CVE ref
* updated sid:1080 - corrected sig to reflect reality
* updated sid:1162 - added CVE ref
* updated sid:1182 - corrected classtype
* updated sid:1187 - corrected MSG to reflect reality
* updated sid:1206 - added CVE ref
* updated sid:1219 - added CVE ref
* updated sid:1589 - corrected MSg to reflect reality
* added the following signatures:
1536 || EXPERIMENTAL WEB-CGI calendar_admin.pl attempt || cve,CVE-2000-0432
1537 || EXPERIMENTAL WEB-CGI calendar_admin.pl access || cve,CVE-2000-0432
1538 || EXPERIMENTAL NNTP AUTHINFO USER overflow attempt || cve,CAN-2000-0341
1539 || EXPERIMENTAL WEB-CGI /cgi-bin/ls access || bugtraq,936 || cve,CAN-2000-0079
1540 || EXPERIMENTAL WEB-COLDFUSION ?Mode=debug attempt
1541 || EXPERIMENTAL FINGER version queary
1542 || EXPERIMENTAL WEB-CGI cgimail access || cve,CVE-2000-0726
1543 || EXPERIMENTAL WEB-CGI cgiwrap access || cve,CVE-2001-0987 || cve,CVE-2000-0431 || cve,CVE-1999-1530
1544 || EXPERIMENTAL WEB-MISC Cisco Catalyst command execution attempt || cve,CAN-2000-0945
1545 || EXPERIMENTAL DOS cisco attempt
1546 || EXPERIMENTAL WEB-MISC cisco /%% DOS attempt
1547 || EXPERIMENTAL WEB-CGI csSearch.cgi attempt || bugtraq,4368
1548 || EXPERIMENTAL WEB-CGI csSearch.cgi access || bugtraq,4368
1549 || EXPERIMENTAL SMTP HELO overflow attempt || cve,CAN-2000-0042
1550 || EXPERIMENTAL SMTP ETRN overflow attempt || cve,CAN-2000-0490
1551 || EXPERIMENTAL WEB-MISC /CVS/Entries access
1552 || EXPERIMENTAL WEB-MISC cvsweb version access || cve,CAN-2000-0670
1553 || EXPERIMENTAL WEB-CGI /cart/cart.cgi access || cve,CVE-2000-0252
1554 || EXPERIMENTAL WEB-CGI dbman db.cgi access || cve,CVE-2000-0381
1555 || EXPERIMENTAL WEB-CGI DCShop access || cve,CAN-2001-0821
1556 || EXPERIMENTAL WEB-CGI DCShop orders.txt access || cve,CAN-2001-0821
1557 || EXPERIMENTAL WEB-CGI DCShop auth_user_file.txt access || cve,CAN-2001-0821
1558 || EXPERIMENTAL WEB-MISC Delegate whois overflow attempt || cve,CVE-2000-0165
1559 || EXPERIMENTAL WEB-MISC /doc/packages access
1560 || EXPERIMENTAL WEB-MISC /doc/ access || bugtraq,318 || cve,CVE-1999-0678
1561 || EXPERIMENTAL WEB-MISC ?open access
1562 || EXPERIMENTAL FTP SITE CHOWN overflow attempt || cve,CAN-2000-0479
1563 || EXPERIMENTAL WEB-MISC login.htm attempt || cve,CAN-1999-1533
1564 || EXPERIMENTAL WEB-MISC login.htm access || cve,CAN-1999-1533
1565 || EXPERIMENTAL WEB-CGI eshop.pl attempt || cve,CAN-2001-1014
1566 || EXPERIMENTAL WEB-CGI eshop.pl access || cve,CAN-2001-1014
1567 || EXPERIMENTAL WEB-MISC /exchange/root.asp attempt
1568 || EXPERIMENTAL WEB-MISC /exchange/root.asp access
1569 || EXPERIMENTAL WEB-CGI loadpage.cgi attempt
1570 || EXPERIMENTAL WEB-CGI loadpage.cgi access
1571 || WEB-CGI dcforum.cgi directory traversal attempt || cve,CAN-2001-0436
1572 || WEB-CGI commerce.cgi attempt || cve,CAN-2001-0210 || bugtraq,2361
1573 || WEB-CGI cgiforum.pl attempt || cve,CVE-2000-1171 || bugtraq,1963
1574 || WEB-CGI directorypro.cgi attempt || cve,CAN-2001-0780
1575 || WEB-MISC Domino mab.nsf access
1576 || WEB-MISC Domino cersvr.nsf access
1577 || WEB-MISC Domino setup.nsf access
1578 || WEB-MISC Domino statrep.nsf access
1579 || WEB-MISC Domino webadmin.nsf access
1580 || WEB-MISC Domino events4.nsf access
1581 || WEB-MISC Domino ntsync4.nsf access
1582 || WEB-MISC Domino collect4.nsf access
1583 || WEB-MISC Domino mailw46.nsf access
1584 || WEB-MISC Domino bookmark.nsf access
1585 || WEB-MISC Domino agentrunner.nsf access
1586 || WEB-MISC Domino mail.box access
1587 || WEB-MISC cgitest.exe access || arachnids,265 || bugtraq,3885 || cve,CVE-2000-1171
1588 || WEB-MISC SalesLogix Eviewer access || cve,CAN-2000-0289 || bugtraq,1089
1589 || WEB-MISC musicat empower attempt
Revision 1.27 / (view) - annotate - [select for diffs] , Sat Mar 23 14:40:20 2002 UTC (8 years ago) by cazz
Branch: MAIN
Changes since 1.26: +37 -37 lines
Diff to previous 1.26 
* Added the following signatures:
1428 || EXPERIMENTAL audio galaxy keepalive
1429 || EXPERIMENTAL poll.gotomypc.com access || url,www.gotomypc.com/help2.tmpl
1430 || EXPERIMENTAL TELNET solaris memory mismanagement exploit attempt
1431 || EXPERIMENTAL BAD TRAFFIC syn to multicast address
1432 || INFO GNUTella GET
1433 || WEB-MISC .history access
1434 || WEB-MISC .bash_history access
1435 || DNS named authors attempt || arachnids,480
1436 || MULTIMEDIA Quicktime User Agent access
1437 || MULTIMEDIA Windows Media audio download
1438 || MULTIMEDIA Windows Media Video download
1439 || MULTIMEDIA Shoutcast playlist redirection
1440 || MULTIMEDIA Icecast playlist redirection
1441 || TFTP GET nc.exe
1442 || TFTP GET shadow
1443 || TFTP GET passwd
1444 || TFTP Get
1445 || FTP file_id.diz access
1446 || SMTP vrfy root

* Massive flow updates.  I hope nobody is using these signatures with 1.8.*
Revision 1.26 / (view) - annotate - [select for diffs] , Wed Mar 6 18:04:23 2002 UTC (8 years ago) by cazz
Branch: MAIN
Changes since 1.25: +3 -4 lines
Diff to previous 1.25 
* rpc keyword is borked, removed from a few of signatures, will remove the
  rest later tonight
Revision 1.25 / (view) - annotate - [select for diffs] , Thu Feb 14 16:30:27 2002 UTC (8 years, 1 month ago) by cazz
Branch: MAIN
Changes since 1.24: +5 -5 lines
Diff to previous 1.24 
* updated sid:588,1274,1298,1299
Revision 1.24 / (view) - annotate - [select for diffs] , Sun Jan 20 17:27:24 2002 UTC (8 years, 2 months ago) by cazz
Branch: MAIN
Changes since 1.23: +9 -9 lines
Diff to previous 1.23 
* regen sid-msg.map
* updated sid:569 - added url ref
* updated sid:570 - added url ref
* updated sid:571 - added url ref
* updated sid:588 - added url ref, added 5 CVE refs
* updated sid:1274 - added url ref, added 5 CVE refs
* updated sid:1298 - added url ref, added 4 CVE refs
* updated sid:1299 - added url ref, added 4 CVE refs
* updated sid:593 - added CVE ref, added url ref
Revision 1.23 / (view) - annotate - [select for diffs] , Sat Jan 19 07:55:29 2002 UTC (8 years, 2 months ago) by cazz
Branch: MAIN
Changes since 1.22: +2 -1 lines
Diff to previous 1.22 
* regened sid-msg.map
* moved frontpage to be after web-iis
* updated sid:1398 - added classtype
* added sid:1399 - EXPERIMENTAL PHP-Nuke remote file include attempt
* moved sid:612 - Belongs in rpc.rules instead of rservices.rules
* updated sid:601 - s/rsh/rlogin/
* updated sid:602 - s/rsh/rlogin/
* updated sid:603 - s/rsh/rlogin/
* updated sid:604 - s/rsh/rlogin/
* updated sid:605 - s/rsh/rlogin/
* updated sid:606 - s/rsh/rlogin/
* updated sid:607 - s/rlogin/rsh/
* updated sid:608 - s/rlogin/rsh/
* updated sid:609 - s/rlogin/rsh/
* updated sid:610 - s/rlogin/rsh/
* updated sid:611 - s/rlogin/rsh/
* disabled sid:617 - wtf does this look for?  nobody knows, lets turn it off
* updated sid:976 - added url REFs.  Removed & from content
* updated sid:1042 - added bugtraq REF
* disabled sid:1045 - generic sig when we have a tight sig
* updated sid:1201 - added depth
Revision 1.22 / (view) - annotate - [select for diffs] , Thu Dec 13 16:31:57 2001 UTC (8 years, 3 months ago) by cazz
Branch: MAIN
Changes since 1.21: +2 -2 lines
Diff to previous 1.21 
* added cmg's kazaa signature
* updated snmpXdmi signature thanks to cmg and info provided by a source
  that wishes to be unnamed.
Revision 1.21 / (view) - annotate - [select for diffs] , Wed Nov 28 22:08:19 2001 UTC (8 years, 3 months ago) by cazz
Branch: MAIN
Changes since 1.20: +3 -3 lines
Diff to previous 1.20 
* statd sig error.  caught by wozz
Revision 1.20 / (view) - annotate - [select for diffs] , Mon Oct 29 01:52:54 2001 UTC (8 years, 4 months ago) by roesch
Branch: MAIN
Changes since 1.19: +2 -1 lines
Diff to previous 1.19 
* Added copyright notices so that the Intrusion.com people might take our intellectual
  property a bit more seriously
Revision 1.19 / (view) - annotate - [select for diffs] , Wed Oct 24 19:05:06 2001 UTC (8 years, 4 months ago) by cazz
Branch: MAIN
Changes since 1.18: +48 -48 lines
Diff to previous 1.18 
* added our first patch of porn signatures
* added suspecious-login classification
* updated classifications on a crapload of rules
* make barnyard defaults in the config file actually be what we say is the default
Revision 1.18 / (view) - annotate - [select for diffs] , Sun Oct 7 14:09:07 2001 UTC (8 years, 5 months ago) by cazz
Branch: MAIN
Changes since 1.17: +9 -7 lines
Diff to previous 1.17 
* Added Tooltak RPC request signature.
* normalized RPC request signatures
Revision 1.17 / (view) - annotate - [select for diffs] , Sat Oct 6 02:14:14 2001 UTC (8 years, 5 months ago) by cazz
Branch: MAIN
Changes since 1.16: +3 -1 lines
Diff to previous 1.16 
* Added new classifications
* added yppasswdd signatures
* removed arachNIDS from a site to go look for rules.  Why tell people about
  a service that is down?
* added a few more web-misc rules
Revision 1.16 / (view) - annotate - [select for diffs] , Mon Oct 1 23:24:28 2001 UTC (8 years, 5 months ago) by roesch
Branch: MAIN
Changes since 1.15: +1 -2 lines
Diff to previous 1.15 
* removed duplicate sid 587
Revision 1.15 / (view) - annotate - [select for diffs] , Thu Sep 6 02:20:51 2001 UTC (8 years, 6 months ago) by cazz
Branch: MAIN
Changes since 1.14: +3 -2 lines
Diff to previous 1.14 
* added UDP version of STATD exploit
* Fixed flags screwup
Revision 1.14 / (view) - annotate - [select for diffs] , Thu Sep 6 02:13:51 2001 UTC (8 years, 6 months ago) by cazz
Branch: MAIN
Changes since 1.13: +27 -6 lines
Diff to previous 1.13 
* UDP/TCP versions of a bunch of RPC queries
Revision 1.13 / (view) - annotate - [select for diffs] , Sun Jul 29 16:36:35 2001 UTC (8 years, 7 months ago) by cazz
Branch: MAIN
Changes since 1.12: +4 -4 lines
Diff to previous 1.12 
* Added CVE & Bugtraq references to a few zillion rules.
* Fixed sid:1048 (caught by John Berkers)
Revision 1.12 / (view) - annotate - [select for diffs] , Mon Jun 11 15:29:30 2001 UTC (8 years, 9 months ago) by cazz
Branch: MAIN
Changes since 1.11: +33 -33 lines
Diff to previous 1.11 
* added support for SID and REV.
* added sid-msg.map (maps SID to MSG)

SID is a unique ID for each rule.  REV is the rule revision.
Revision 1.11 / (view) - annotate - [select for diffs] , Tue Jun 5 15:57:55 2001 UTC (8 years, 9 months ago) by cazz
Branch: MAIN
Changes since 1.10: +2 -2 lines
Diff to previous 1.10 
Oops.  Multiple classifications = bad.
Revision 1.10 / (view) - annotate - [select for diffs] , Wed May 16 04:00:45 2001 UTC (8 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.9: +4 -2 lines
Diff to previous 1.9 
* Added sgi_espd RPC query (SGI Advisory 20010501-01-P)
* Mentioned that virus rules are NOT being maintained
* Added iPlanet GETPROPERTIES attempt rule (See eEye advisory)
Revision 1.9 / (view) - annotate - [select for diffs] , Thu Apr 26 03:39:40 2001 UTC (8 years, 10 months ago) by cazz
Branch: MAIN
Changes since 1.8: +11 -11 lines
Diff to previous 1.8 
* added some sanity to rule ordering of RPC rules
Revision 1.8 / (view) - annotate - [select for diffs] , Thu Apr 19 06:27:49 2001 UTC (8 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.7: +2 -2 lines
Diff to previous 1.7 
Oops.  And thats what I get for writing snort rules at 2 in the morning.
Revision 1.7 / (view) - annotate - [select for diffs] , Thu Apr 19 06:07:08 2001 UTC (8 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.6: +2 -1 lines
Diff to previous 1.6 
Added snmpXdmi RPC/overflow leadin rule.  We might want to check for the shell code too...
Revision 1.6 / (view) - annotate - [select for diffs] , Tue Apr 17 03:32:46 2001 UTC (8 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.5: +30 -35 lines
Diff to previous 1.5 
* Changed default $HOME_NET to any (watch as marty changes it right back :P)
* Added classifications to almost every rule

NOTE:
We are currently using IDMEF's classifications.  This may change soon.
This is an extremely SIMPLE and well defined set of rule classifications
and priorities.  It is completely changeable.  Read sp_priority and
classification.conf for more information.
Revision 1.5 / (view) - annotate - [select for diffs] , Mon Apr 16 03:03:38 2001 UTC (8 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.4: +1 -5 lines
Diff to previous 1.4 
Don't let vim add $ Log $ when I don't tell it to
Revision 1.4 / (view) - annotate - [select for diffs] , Thu Apr 5 15:24:11 2001 UTC (8 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.3: +8 -4 lines
Diff to previous 1.3 
updated broken rules from last database export
Revision 1.3 / (view) - annotate - [select for diffs] , Wed Apr 4 23:07:50 2001 UTC (8 years, 11 months ago) by cazz
Branch: MAIN
Changes since 1.2: +10 -7 lines
Diff to previous 1.2 
Added x11.rules, x11.rules, and virus.rules
Revision 1.2 / (view) - annotate - [select for diffs] , Mon Mar 26 02:00:31 2001 UTC (8 years, 11 months ago) by roesch
Branch: MAIN
Changes since 1.1: +6 -4 lines
Diff to previous 1.1 
* Many changes, read the diffs or see the mailing list
Revision 1.1 / (view) - annotate - [select for diffs] , Sat Mar 10 15:42:09 2001 UTC (9 years ago) by roesch
Branch: MAIN 
* Disabled reseerved bits scan detection, false positives for ECN traffic
  aren't detectable with the current code and I'm seeing a lot of noise
  out there about this...
* committed the new rules set from Forster/Caswell
This form allows you to request diffs between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.

Diffs between and
Type of Diff should be a
View only Branch:
Sort log by:
snort-team@sourcefire.com